Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
cMqyGFCQHk.exe

Overview

General Information

Sample name:cMqyGFCQHk.exe
renamed because original name is a hash value
Original sample name:3c3f458400c557d279c4d4993f67adc8ba3da4bad8fc844adfef8c7de475a1f7.exe
Analysis ID:1556006
MD5:b408e3da98f0e457d627510165374ddd
SHA1:49de055d881896670ce8b1ba1633d5f8b4f8e193
SHA256:3c3f458400c557d279c4d4993f67adc8ba3da4bad8fc844adfef8c7de475a1f7
Tags:exeLionSoftwareLLCuser-JAMESWT_MHT
Infos:

Detection

Score:60
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Sigma detected: Powershell create lnk in startup
Drops large PE files
Powershell creates an autostart link
Sigma detected: Potential Startup Shortcut Persistence Via PowerShell.EXE
Contains functionality for read data from the clipboard
Contains functionality to shutdown / reboot the system
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Creates a start menu entry (Start Menu\Programs\Startup)
Detected potential crypto function
Drops PE files
Enables debug privileges
Enables security privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found dropped PE file which has not been started or loaded
Installs a raw input device (often for capturing keystrokes)
May sleep (evasive loops) to hinder dynamic analysis
PE / OLE file has an invalid certificate
PE file contains more sections than normal
PE file contains sections with non-standard names
Queries information about the installed CPU (vendor, model number etc)
Queries keyboard layouts
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Sigma detected: Startup Folder File Write
Sigma detected: Suspicious Electron Application Child Processes
Stores files to the Windows start menu directory
Uses 32bit PE files
Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

  • System is w10x64
  • cMqyGFCQHk.exe (PID: 5476 cmdline: "C:\Users\user\Desktop\cMqyGFCQHk.exe" MD5: B408E3DA98F0E457D627510165374DDD)
    • cmd.exe (PID: 3212 cmdline: "C:\Windows\system32\cmd.exe" /c tasklist /FI "USERNAME eq %USERNAME%" /FI "IMAGENAME eq Teams.exe" /FO csv | "C:\Windows\system32\find.exe" "Teams.exe" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)
      • conhost.exe (PID: 7084 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • tasklist.exe (PID: 356 cmdline: tasklist /FI "USERNAME eq user" /FI "IMAGENAME eq Teams.exe" /FO csv MD5: 0A4448B31CE7F83CB7691A2657F330F1)
      • find.exe (PID: 4032 cmdline: "C:\Windows\system32\find.exe" "Teams.exe" MD5: 15B158BC998EEF74CFDD27C44978AEA0)
  • Teams.exe (PID: 7128 cmdline: "C:\Users\user\AppData\Local\Programs\Teams\Teams.exe" MD5: 102326801694C938E466C8D96E4200BD)
    • cmd.exe (PID: 776 cmdline: C:\Windows\system32\cmd.exe /d /s /c "powershell "$s=(New-Object -COM WScript.Shell).CreateShortcut('C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MyElectronApp.lnk');$s.TargetPath='C:\Users\user\AppData\Local\Programs\Teams\Teams.exe';$s.Save()"" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
      • conhost.exe (PID: 5748 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • powershell.exe (PID: 2896 cmdline: powershell "$s=(New-Object -COM WScript.Shell).CreateShortcut('C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MyElectronApp.lnk');$s.TargetPath='C:\Users\user\AppData\Local\Programs\Teams\Teams.exe';$s.Save()" MD5: 04029E121A0CFA5991749937DD22A1D9)
    • Teams.exe (PID: 6448 cmdline: "C:\Users\user\AppData\Local\Programs\Teams\Teams.exe" --type=gpu-process --user-data-dir="C:\Users\user\AppData\Roaming\Teams" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=1804,i,4916229494749615140,4144486409714305981,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=1796 /prefetch:2 MD5: 102326801694C938E466C8D96E4200BD)
    • Teams.exe (PID: 4148 cmdline: "C:\Users\user\AppData\Local\Programs\Teams\Teams.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --user-data-dir="C:\Users\user\AppData\Roaming\Teams" --field-trial-handle=2464,i,4916229494749615140,4144486409714305981,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2416 /prefetch:3 MD5: 102326801694C938E466C8D96E4200BD)
    • Teams.exe (PID: 3080 cmdline: "C:\Users\user\AppData\Local\Programs\Teams\Teams.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --user-data-dir="C:\Users\user\AppData\Roaming\Teams" --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=2548,i,4916229494749615140,4144486409714305981,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2544 /prefetch:8 MD5: 102326801694C938E466C8D96E4200BD)
  • Teams.exe (PID: 5544 cmdline: "C:\Users\user\AppData\Local\Programs\Teams\Teams.exe" MD5: 102326801694C938E466C8D96E4200BD)
    • Teams.exe (PID: 7072 cmdline: "C:\Users\user\AppData\Local\Programs\Teams\Teams.exe" --type=gpu-process --user-data-dir="C:\Users\user\AppData\Roaming\Teams" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=1704,i,126123718397027599,14626746628952611418,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=1696 /prefetch:2 MD5: 102326801694C938E466C8D96E4200BD)
    • cmd.exe (PID: 4176 cmdline: C:\Windows\system32\cmd.exe /d /s /c "powershell "$s=(New-Object -COM WScript.Shell).CreateShortcut('C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MyElectronApp.lnk');$s.TargetPath='C:\Users\user\AppData\Local\Programs\Teams\Teams.exe';$s.Save()"" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
      • conhost.exe (PID: 6504 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • powershell.exe (PID: 4020 cmdline: powershell "$s=(New-Object -COM WScript.Shell).CreateShortcut('C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MyElectronApp.lnk');$s.TargetPath='C:\Users\user\AppData\Local\Programs\Teams\Teams.exe';$s.Save()" MD5: 04029E121A0CFA5991749937DD22A1D9)
    • Teams.exe (PID: 6900 cmdline: "C:\Users\user\AppData\Local\Programs\Teams\Teams.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --user-data-dir="C:\Users\user\AppData\Roaming\Teams" --field-trial-handle=2428,i,126123718397027599,14626746628952611418,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2424 /prefetch:3 MD5: 102326801694C938E466C8D96E4200BD)
    • Teams.exe (PID: 4000 cmdline: "C:\Users\user\AppData\Local\Programs\Teams\Teams.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --user-data-dir="C:\Users\user\AppData\Roaming\Teams" --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=1200,i,126123718397027599,14626746628952611418,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2484 /prefetch:8 MD5: 102326801694C938E466C8D96E4200BD)
  • cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

⊘No yara matches

Sigma Signatures

System Summary

barindex
Sigma detected: Potential Startup Shortcut Persistence Via PowerShell.EXE
Source: File createdAuthor: Christopher Peacock '@securepeacock', SCYTHE: Data: EventID: 11, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 2896, TargetFilename: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MyElectronApp.lnk
Sigma detected: Startup Folder File Write
Source: File createdAuthor: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research): Data: EventID: 11, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 2896, TargetFilename: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MyElectronApp.lnk
Sigma detected: Suspicious Electron Application Child Processes
Source: Process startedAuthor: Nasreddine Bencherchali (Nextron Systems): Data: Command: C:\Windows\system32\cmd.exe /d /s /c "powershell "$s=(New-Object -COM WScript.Shell).CreateShortcut('C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MyElectronApp.lnk');$s.TargetPath='C:\Users\user\AppData\Local\Programs\Teams\Teams.exe';$s.Save()"", CommandLine: C:\Windows\system32\cmd.exe /d /s /c "powershell "$s=(New-Object -COM WScript.Shell).CreateShortcut('C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MyElectronApp.lnk');$s.TargetPath='C:\Users\user\AppData\Local\Programs\Teams\Teams.exe';$s.Save()"", CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: "C:\Users\user\AppData\Local\Programs\Teams\Teams.exe" , ParentImage: C:\Users\user\AppData\Local\Programs\Teams\Teams.exe, ParentProcessId: 7128, ParentProcessName: Teams.exe, ProcessCommandLine: C:\Windows\system32\cmd.exe /d /s /c "powershell "$s=(New-Object -COM WScript.Shell).CreateShortcut('C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MyElectronApp.lnk');$s.TargetPath='C:\Users\user\AppData\Local\Programs\Teams\Teams.exe';$s.Save()"", ProcessId: 776, ProcessName: cmd.exe
Sigma detected: Non Interactive PowerShell Process Spawned
Source: Process startedAuthor: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell "$s=(New-Object -COM WScript.Shell).CreateShortcut('C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MyElectronApp.lnk');$s.TargetPath='C:\Users\user\AppData\Local\Programs\Teams\Teams.exe';$s.Save()", CommandLine: powershell "$s=(New-Object -COM WScript.Shell).CreateShortcut('C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MyElectronApp.lnk');$s.TargetPath='C:\Users\user\AppData\Local\Programs\Teams\Teams.exe';$s.Save()", CommandLine|base64offset|contains: ^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: C:\Windows\system32\cmd.exe /d /s /c "powershell "$s=(New-Object -COM WScript.Shell).CreateShortcut('C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MyElectronApp.lnk');$s.TargetPath='C:\Users\user\AppData\Local\Programs\Teams\Teams.exe';$s.Save()"", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 776, ParentProcessName: cmd.exe, ProcessCommandLine: powershell "$s=(New-Object -COM WScript.Shell).CreateShortcut('C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MyElectronApp.lnk');$s.TargetPath='C:\Users\user\AppData\Local\Programs\Teams\Teams.exe';$s.Save()", ProcessId: 2896, ProcessName: powershell.exe

Persistence and Installation Behavior

barindex
Sigma detected: Powershell create lnk in startup
Source: Process startedAuthor: Joe Security: Data: Command: C:\Windows\system32\cmd.exe /d /s /c "powershell "$s=(New-Object -COM WScript.Shell).CreateShortcut('C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MyElectronApp.lnk');$s.TargetPath='C:\Users\user\AppData\Local\Programs\Teams\Teams.exe';$s.Save()"", CommandLine: C:\Windows\system32\cmd.exe /d /s /c "powershell "$s=(New-Object -COM WScript.Shell).CreateShortcut('C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MyElectronApp.lnk');$s.TargetPath='C:\Users\user\AppData\Local\Programs\Teams\Teams.exe';$s.Save()"", CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: "C:\Users\user\AppData\Local\Programs\Teams\Teams.exe" , ParentImage: C:\Users\user\AppData\Local\Programs\Teams\Teams.exe, ParentProcessId: 7128, ParentProcessName: Teams.exe, ProcessCommandLine: C:\Windows\system32\cmd.exe /d /s /c "powershell "$s=(New-Object -COM WScript.Shell).CreateShortcut('C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MyElectronApp.lnk');$s.TargetPath='C:\Users\user\AppData\Local\Programs\Teams\Teams.exe';$s.Save()"", ProcessId: 776, ProcessName: cmd.exe

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results
Source: cMqyGFCQHk.exeStatic PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
Source: C:\Users\user\Desktop\cMqyGFCQHk.exeRegistry value created: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\8013f783-e1a2-5f53-80da-b1ad483bd59fJump to behavior
Source: C:\Users\user\Desktop\cMqyGFCQHk.exeFile created: C:\Users\user\AppData\Local\Temp\nshFAEA.tmp\7z-out\LICENSE.electron.txtJump to behavior
Source: C:\Users\user\Desktop\cMqyGFCQHk.exeFile created: C:\Users\user\AppData\Local\Programs\Teams\LICENSE.electron.txtJump to behavior
Source: cMqyGFCQHk.exeStatic PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Source: Binary string: ffmpeg.dll.pdb source: cMqyGFCQHk.exe, 00000000.00000003.2411113268.000000000519B000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D3DCompiler_47.pdb source: cMqyGFCQHk.exe, 00000000.00000003.2409838844.000000000519E000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: libEGL.dll.pdb source: cMqyGFCQHk.exe, 00000000.00000003.2415397263.0000000004C34000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\dev\test\x64\Release\test.pdb source: cMqyGFCQHk.exe, 00000000.00000003.2483412748.0000000004DF1000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: vulkan-1.dll.pdb source: cMqyGFCQHk.exe, 00000000.00000003.2406041139.00000000066F0000.00000004.00001000.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2402713940.0000000005CF0000.00000004.00001000.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2402317830.0000000005330000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: C:\dev\test\Release\test.pdb source: cMqyGFCQHk.exe, 00000000.00000003.2483647992.0000000004DF1000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D3DCompiler_47.pdbGCTL source: cMqyGFCQHk.exe, 00000000.00000003.2409838844.000000000519E000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: electron.exe.pdb source: cMqyGFCQHk.exe, 00000000.00000003.2407447233.00000000073F3000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: <C:\dev\test\x64\Release\test.pdb source: cMqyGFCQHk.exe, 00000000.00000003.2483412748.0000000004DF1000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: libGLESv2.dll.pdb source: cMqyGFCQHk.exe, 00000000.00000003.2416602923.0000000005190000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2317642252.0000000006AF0000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: vk_swiftshader.dll.pdb source: cMqyGFCQHk.exe, 00000000.00000003.2477515999.000000000519A000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2406552229.0000000006AF0000.00000004.00001000.00020000.00000000.sdmp
Source: C:\Users\user\Desktop\cMqyGFCQHk.exeCode function: 0_2_004059CC GetTempPathW,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose,0_2_004059CC
Source: C:\Users\user\Desktop\cMqyGFCQHk.exeCode function: 0_2_004065FD FindFirstFileW,FindClose,0_2_004065FD
Source: C:\Users\user\Desktop\cMqyGFCQHk.exeCode function: 0_2_00402868 FindFirstFileW,0_2_00402868
Source: C:\Users\user\Desktop\cMqyGFCQHk.exeFile opened: C:\Users\user\AppData\Local\Temp\nshFAEA.tmp\7z-out\resources\app.asar.unpacked\node_modulesJump to behavior
Source: C:\Users\user\Desktop\cMqyGFCQHk.exeFile opened: C:\Users\user\AppData\Local\Temp\nshFAEA.tmp\7z-out\resources\app.asar.unpacked\node_modules\ps-listJump to behavior
Source: C:\Users\user\Desktop\cMqyGFCQHk.exeFile opened: C:\Users\user\AppData\Local\Temp\nshFAEA.tmp\7z-out\localesJump to behavior
Source: C:\Users\user\Desktop\cMqyGFCQHk.exeFile opened: C:\Users\user\AppData\Local\Temp\nshFAEA.tmp\7z-out\resources\app.asar.unpacked\node_modules\ps-list\vendorJump to behavior
Source: C:\Users\user\Desktop\cMqyGFCQHk.exeFile opened: C:\Users\user\AppData\Local\Temp\nshFAEA.tmp\7z-out\resourcesJump to behavior
Source: C:\Users\user\Desktop\cMqyGFCQHk.exeFile opened: C:\Users\user\AppData\Local\Temp\nshFAEA.tmp\7z-out\resources\app.asar.unpackedJump to behavior
Source: cMqyGFCQHk.exe, 00000000.00000003.2304404903.00000000057F0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: * **Google Hangouts Video**: http://www.youtube.com/watch?v=I9nDOSGfwZg equals www.youtube.com (Youtube)
Source: cMqyGFCQHk.exe, 00000000.00000003.2304404903.00000000057F0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://2x.io)
Source: cMqyGFCQHk.exe, 00000000.00000003.2304404903.00000000057F0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://blog.izs.me/)
Source: cMqyGFCQHk.exe, 00000000.00000003.2407447233.00000000073F3000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://certificates.godaddy.com/repository/gd_intermediate.crt0
Source: cMqyGFCQHk.exe, 00000000.00000003.2407447233.00000000073F3000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://certificates.godaddy.com/repository100.
Source: cMqyGFCQHk.exe, 00000000.00000003.2406907152.0000000006EF0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://code.google.com/p/closure-compiler/wiki/SourceMaps
Source: cMqyGFCQHk.exe, 00000000.00000003.2293258093.0000000005CF0000.00000004.00001000.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2418539279.0000000005197000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://code.google.com/p/python-gflags/
Source: cMqyGFCQHk.exe, 00000000.00000003.2293258093.0000000005CF0000.00000004.00001000.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2418539279.0000000005197000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://code.google.com/p/smhasher/
Source: cMqyGFCQHk.exe, 00000000.00000003.2406907152.0000000006EF0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06
Source: cMqyGFCQHk.exe, 00000000.00000003.2406907152.0000000006EF0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://crl.comodoca.com/COMODOCertificationAuthority.crl0
Source: cMqyGFCQHk.exe, 00000000.00000003.2407447233.00000000073F3000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://crl.godaddy.com/gds1-20
Source: cMqyGFCQHk.exe, 00000000.00000003.2407447233.00000000073F3000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://exslt.org/common
Source: cMqyGFCQHk.exe, 00000000.00000003.2407447233.00000000073F3000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://exslt.org/commonnode-set..
Source: cMqyGFCQHk.exe, 00000000.00000003.2304404903.00000000057F0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://feross.org
Source: cMqyGFCQHk.exe, 00000000.00000003.2304404903.00000000057F0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://fresc81.github.io/node-winreg
Source: cMqyGFCQHk.exe, 00000000.00000003.2304404903.00000000057F0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://github.com/troygoode/)
Source: cMqyGFCQHk.exe, 00000000.00000003.2293258093.0000000005CF0000.00000004.00001000.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2418539279.0000000005197000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://google.github.io/snappy/
Source: cMqyGFCQHk.exe, 00000000.00000003.2407447233.00000000073F3000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://icl.com/saxon
Source: cMqyGFCQHk.exe, 00000000.00000003.2407447233.00000000073F3000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://icl.com/saxonorg.apache.xalan.xslt.extensions.RedirectxsltDocumentElem:
Source: cMqyGFCQHk.exe, 00000000.00000003.2304404903.00000000057F0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://n8.io/)
Source: cMqyGFCQHk.exe, 00000000.00000002.2527514411.000000000040A000.00000004.00000001.01000000.00000003.sdmp, cMqyGFCQHk.exe, 00000000.00000000.2217681375.000000000040A000.00000008.00000001.01000000.00000003.sdmpString found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: cMqyGFCQHk.exe, 00000000.00000003.2407447233.00000000073F3000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://ocsp.godaddy.com/0J
Source: cMqyGFCQHk.exe, 00000000.00000003.2293258093.0000000005CF0000.00000004.00001000.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2418539279.0000000005197000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://opensource.perlig.de/rjsmin/
Source: cMqyGFCQHk.exe, 00000000.00000003.2407447233.00000000073F3000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://s..
Source: cMqyGFCQHk.exe, 00000000.00000003.2406907152.0000000006EF0000.00000004.00001000.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2406552229.0000000006AF0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://src.chromium.org/viewvc/blink/trunk/Source/devtools/front_end/SourceMap.js
Source: cMqyGFCQHk.exe, 00000000.00000003.2304404903.00000000057F0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://stackoverflow.com/a/1068308/13216
Source: cMqyGFCQHk.exe, 00000000.00000003.2304404903.00000000057F0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://substack.net
Source: cMqyGFCQHk.exe, 00000000.00000003.2304404903.00000000057F0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://travis-ci.org/troygoode/node-require-directory)
Source: cMqyGFCQHk.exe, 00000000.00000003.2406552229.0000000006AF0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://userguide.icu-project.org/strings/properties
Source: cMqyGFCQHk.exe, 00000000.00000003.2293258093.0000000005CF0000.00000004.00001000.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2418539279.0000000005197000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.apache.org/licenses/
Source: cMqyGFCQHk.exe, 00000000.00000003.2293258093.0000000005CF0000.00000004.00001000.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2418539279.0000000005197000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: cMqyGFCQHk.exe, 00000000.00000003.2304404903.00000000057F0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://www.futurealoof.com)
Source: cMqyGFCQHk.exe, 00000000.00000003.2293258093.0000000005CF0000.00000004.00001000.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2418539279.0000000005197000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.gutenberg.org/ebooks/53).
Source: cMqyGFCQHk.exe, 00000000.00000003.2407447233.00000000073F3000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://www.jclark.com/xt
Source: cMqyGFCQHk.exe, 00000000.00000003.2406552229.0000000006AF0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://www.midnight-commander.org/browser/lib/tty/key.c
Source: cMqyGFCQHk.exe, 00000000.00000003.2293258093.0000000005CF0000.00000004.00001000.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2418539279.0000000005197000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.opensource.org/licenses/bsd-license.php
Source: cMqyGFCQHk.exe, 00000000.00000003.2304404903.00000000057F0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://www.opensource.org/licenses/mit-license.php)
Source: cMqyGFCQHk.exe, 00000000.00000003.2293258093.0000000005CF0000.00000004.00001000.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2418539279.0000000005197000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.pertinentdetail.org/sqrt
Source: cMqyGFCQHk.exe, 00000000.00000003.2293258093.0000000005CF0000.00000004.00001000.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2418539279.0000000005197000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.ploscompbiol.org/static/license
Source: cMqyGFCQHk.exe, 00000000.00000003.2293258093.0000000005CF0000.00000004.00001000.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2418539279.0000000005197000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.polymer-project.org
Source: cMqyGFCQHk.exe, 00000000.00000003.2293258093.0000000005CF0000.00000004.00001000.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2418539279.0000000005197000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.portaudio.com
Source: cMqyGFCQHk.exe, 00000000.00000003.2293258093.0000000005CF0000.00000004.00001000.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2418539279.0000000005197000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.softsynth.com
Source: cMqyGFCQHk.exe, 00000000.00000003.2304404903.00000000057F0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://www.youtube.com/watch?v=I9nDOSGfwZg
Source: cMqyGFCQHk.exe, 00000000.00000003.2407447233.00000000073F3000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://xmlsoft.org/XSLT/
Source: cMqyGFCQHk.exe, 00000000.00000003.2407447233.00000000073F3000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://xmlsoft.org/XSLT/namespace
Source: cMqyGFCQHk.exe, 00000000.00000003.2407447233.00000000073F3000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://xmlsoft.org/XSLT/namespacehttp://www.jclark.com/xtxsl:key
Source: cMqyGFCQHk.exe, 00000000.00000003.2407447233.00000000073F3000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://xmlsoft.org/XSLT/xsltNewExtDef
Source: cMqyGFCQHk.exe, 00000000.00000003.2406907152.0000000006EF0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://%s:%d/.well-known/masque/udp/%s/%d/
Source: cMqyGFCQHk.exe, 00000000.00000003.2406907152.0000000006EF0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://%s:%d/.well-known/masque/udp/%s/%d/Net.QuicStreamFactory.DefaultNetworkMatchNet.QuicSession.
Source: cMqyGFCQHk.exe, 00000000.00000003.2407447233.00000000073F3000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://android.com/pay
Source: cMqyGFCQHk.exe, 00000000.00000003.2293258093.0000000005CF0000.00000004.00001000.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2418539279.0000000005197000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://android.googlesource.com/platform/external/puffin
Source: cMqyGFCQHk.exe, 00000000.00000003.2407447233.00000000073F3000.00000004.00001000.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2406907152.0000000007248000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://beacons.gcp.gvt2.com/domainreliability/upload
Source: cMqyGFCQHk.exe, 00000000.00000003.2407447233.00000000073F3000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://beacons.gcp.gvt2.com/domainreliability/uploadhttps://beacons.gvt2.com/domainreliability/uplo
Source: cMqyGFCQHk.exe, 00000000.00000003.2407447233.00000000073F3000.00000004.00001000.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2406907152.0000000007248000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://beacons.gvt2.com/domainreliability/upload
Source: cMqyGFCQHk.exe, 00000000.00000003.2407447233.00000000073F3000.00000004.00001000.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2406907152.0000000007248000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://beacons2.gvt2.com/domainreliability/upload
Source: cMqyGFCQHk.exe, 00000000.00000003.2407447233.00000000073F3000.00000004.00001000.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2406907152.0000000007248000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://beacons3.gvt2.com/domainreliability/upload
Source: cMqyGFCQHk.exe, 00000000.00000003.2407447233.00000000073F3000.00000004.00001000.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2406907152.0000000007248000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://beacons4.gvt2.com/domainreliability/upload
Source: cMqyGFCQHk.exe, 00000000.00000003.2407447233.00000000073F3000.00000004.00001000.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2406907152.0000000007248000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://beacons5.gvt2.com/domainreliability/upload
Source: cMqyGFCQHk.exe, 00000000.00000003.2407447233.00000000073F3000.00000004.00001000.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2406907152.0000000007248000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://beacons5.gvt3.com/domainreliability/upload
Source: cMqyGFCQHk.exe, 00000000.00000003.2407447233.00000000073F3000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://bit.ly/audio-worklet)
Source: cMqyGFCQHk.exe, 00000000.00000003.2407447233.00000000073F3000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://bit.ly/audio-worklet)..
Source: cMqyGFCQHk.exe, 00000000.00000003.2406907152.0000000006EF0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://blog.chromium.org/2019/10/no-more-mixed-messages-about-https.html
Source: cMqyGFCQHk.exe, 00000000.00000003.2406907152.0000000006EF0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://blog.chromium.org/2019/10/no-more-mixed-messages-about-https.htmlMixed
Source: cMqyGFCQHk.exe, 00000000.00000003.2478846758.0000000004C34000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://chrome.google.com/webstore?hl=et&category=theme81https://myactivity.google.com/myactivity/?u
Source: cMqyGFCQHk.exe, 00000000.00000003.2479386329.0000000004C34000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://chrome.google.com/webstore?hl=hu&category=theme81https://myactivity.google.com/myactivity/?u
Source: cMqyGFCQHk.exe, 00000000.00000003.2480625633.0000000004C34000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://chrome.google.com/webstore?hl=pl&category=theme81https://myactivity.google.com/myactivity/?u
Source: cMqyGFCQHk.exe, 00000000.00000003.2478846758.0000000004C34000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://chromeenterprise.google/policies/#BrowserSwitcherEnabled
Source: cMqyGFCQHk.exe, 00000000.00000003.2478846758.0000000004C34000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://chromeenterprise.google/policies/#BrowserSwitcherExternalGreylistUrl
Source: cMqyGFCQHk.exe, 00000000.00000003.2478846758.0000000004C34000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://chromeenterprise.google/policies/#BrowserSwitcherExternalSitelistUrl
Source: cMqyGFCQHk.exe, 00000000.00000003.2478846758.0000000004C34000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://chromeenterprise.google/policies/#BrowserSwitcherUrlGreylist
Source: cMqyGFCQHk.exe, 00000000.00000003.2478846758.0000000004C34000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://chromeenterprise.google/policies/#BrowserSwitcherUrlList
Source: cMqyGFCQHk.exe, 00000000.00000003.2478846758.0000000004C34000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://chromeenterprise.google/policies/#BrowserSwitcherUseIeSitelist
Source: cMqyGFCQHk.exe, 00000000.00000003.2406907152.0000000006EF0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://chromestatus.com/feature/5105856067141632.
Source: cMqyGFCQHk.exe, 00000000.00000003.2479386329.0000000004C34000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2480625633.0000000004C34000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2478846758.0000000004C34000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2481468216.0000000004C34000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2477975318.0000000004C34000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2478464913.0000000004C34000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://chromestatus.com/features#browsers.chrome.status%3A%22Deprecated%22
Source: cMqyGFCQHk.exe, 00000000.00000003.2407447233.00000000073F3000.00000004.00001000.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2293258093.0000000005CF0000.00000004.00001000.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2418539279.0000000005197000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://chromium.googlesource.com/chromium/src/
Source: cMqyGFCQHk.exe, 00000000.00000003.2407447233.00000000073F3000.00000004.00001000.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2406907152.0000000007248000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://clients2.google.com/domainreliability/upload
Source: cMqyGFCQHk.exe, 00000000.00000003.2406907152.0000000006EF0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://code.google.com/p/chromium/issues/detail?id=25916
Source: cMqyGFCQHk.exe, 00000000.00000003.2304404903.00000000057F0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://code.google.com/p/v8/wiki/JavaScriptStackTraceApi
Source: cMqyGFCQHk.exe, 00000000.00000003.2406552229.0000000006AF0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://console.spec.whatwg.org/#clear
Source: cMqyGFCQHk.exe, 00000000.00000003.2406552229.0000000006AF0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://console.spec.whatwg.org/#console-namespace
Source: cMqyGFCQHk.exe, 00000000.00000003.2406552229.0000000006AF0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://console.spec.whatwg.org/#count
Source: cMqyGFCQHk.exe, 00000000.00000003.2406552229.0000000006AF0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://console.spec.whatwg.org/#count-map
Source: cMqyGFCQHk.exe, 00000000.00000003.2406552229.0000000006AF0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://console.spec.whatwg.org/#countreset
Source: cMqyGFCQHk.exe, 00000000.00000003.2406552229.0000000006AF0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://console.spec.whatwg.org/#table
Source: cMqyGFCQHk.exe, 00000000.00000003.2406907152.0000000006EF0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://crbug.com/1038223.
Source: cMqyGFCQHk.exe, 00000000.00000003.2407447233.00000000073F3000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://crbug.com/1144908
Source: cMqyGFCQHk.exe, 00000000.00000003.2407447233.00000000073F3000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://crbug.com/1144908.
Source: cMqyGFCQHk.exe, 00000000.00000003.2407447233.00000000073F3000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://crbug.com/1144908.The
Source: cMqyGFCQHk.exe, 00000000.00000003.2407447233.00000000073F3000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://crbug.com/1144908Changing
Source: cMqyGFCQHk.exe, 00000000.00000003.2407447233.00000000073F3000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://crbug.com/1429681
Source: cMqyGFCQHk.exe, 00000000.00000003.2406907152.0000000006EF0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://crbug.com/927119
Source: cMqyGFCQHk.exe, 00000000.00000003.2406907152.0000000006EF0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://crbug.com/927119Blink.Script.SchedulingTypeScriptLoader
Source: cMqyGFCQHk.exe, 00000000.00000003.2406907152.0000000006EF0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://crbug.com/981419
Source: cMqyGFCQHk.exe, 00000000.00000003.2406552229.0000000006AF0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://crbug.com/v8/7848
Source: cMqyGFCQHk.exe, 00000000.00000003.2293258093.0000000005CF0000.00000004.00001000.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2418539279.0000000005197000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://creativecommons.org/licenses/by/3.0/
Source: cMqyGFCQHk.exe, 00000000.00000003.2406552229.0000000006AF0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://cs.chromium.org/chromium/src/v8/tools/SourceMap.js?rcl=dd10454c1d
Source: cMqyGFCQHk.exe, 00000000.00000003.2407447233.00000000073F3000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://datatracker.ietf.org/doc/draft-ietf-rtcweb-ip-handling.
Source: cMqyGFCQHk.exe, 00000000.00000003.2406552229.0000000006AF0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://datatracker.ietf.org/doc/html/rfc7231#section-6.4
Source: cMqyGFCQHk.exe, 00000000.00000003.2406552229.0000000006AF0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://datatracker.ietf.org/doc/html/rfc7238
Source: cMqyGFCQHk.exe, 00000000.00000003.2406907152.0000000006EF0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://developer.chrome.com/blog/enabling-shared-array-buffer/
Source: cMqyGFCQHk.exe, 00000000.00000003.2406907152.0000000006EF0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://developer.chrome.com/docs/extensions/mv3/cross-origin-isolation/.
Source: cMqyGFCQHk.exe, 00000000.00000003.2407447233.00000000073F3000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://developer.chrome.com/docs/extensions/mv3/service_workers/events/
Source: cMqyGFCQHk.exe, 00000000.00000003.2407447233.00000000073F3000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://developer.chrome.com/docs/extensions/mv3/service_workers/events/Script
Source: cMqyGFCQHk.exe, 00000000.00000003.2406552229.0000000006AF0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://developer.mozilla.org/en-US/docs/Web/API/PerformanceResourceTiming
Source: cMqyGFCQHk.exe, 00000000.00000003.2406552229.0000000006AF0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://developer.mozilla.org/en-US/docs/Web/JavaScript/Equality_comparisons_and_sameness#Loose_equa
Source: cMqyGFCQHk.exe, 00000000.00000003.2304404903.00000000057F0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/String/endsWith
Source: cMqyGFCQHk.exe, 00000000.00000003.2304404903.00000000057F0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/String/includes
Source: cMqyGFCQHk.exe, 00000000.00000003.2304404903.00000000057F0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/String/startsWith
Source: cMqyGFCQHk.exe, 00000000.00000003.2304404903.00000000057F0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://docs.google.com/document/d/17aTgLnjMXIrfjgNaTUnHQO7m3xgzHR2VXBTmi03Qii4/
Source: cMqyGFCQHk.exe, 00000000.00000003.2406552229.0000000006AF0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://dom.spec.whatwg.org/#dom-event-stopimmediatepropagation
Source: cMqyGFCQHk.exe, 00000000.00000003.2406552229.0000000006AF0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://dom.spec.whatwg.org/#interface-abortcontroller
Source: cMqyGFCQHk.exe, 00000000.00000003.2406552229.0000000006AF0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://dom.spec.whatwg.org/#interface-eventtarget
Source: cMqyGFCQHk.exe, 00000000.00000003.2304404903.00000000057F0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://domenic.me/)
Source: cMqyGFCQHk.exe, 00000000.00000003.2406552229.0000000006AF0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://encoding.spec.whatwg.org
Source: cMqyGFCQHk.exe, 00000000.00000003.2406552229.0000000006AF0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://encoding.spec.whatwg.org/#encode-and-enqueue-a-chunk
Source: cMqyGFCQHk.exe, 00000000.00000003.2406552229.0000000006AF0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://encoding.spec.whatwg.org/#encode-and-flush
Source: cMqyGFCQHk.exe, 00000000.00000003.2406552229.0000000006AF0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://encoding.spec.whatwg.org/#textdecoder
Source: cMqyGFCQHk.exe, 00000000.00000003.2406552229.0000000006AF0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://encoding.spec.whatwg.org/#textencoder
Source: cMqyGFCQHk.exe, 00000000.00000003.2407447233.00000000073F3000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://example.org
Source: cMqyGFCQHk.exe, 00000000.00000003.2407447233.00000000073F3000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://example.orgExpired
Source: cMqyGFCQHk.exe, 00000000.00000003.2304404903.00000000057F0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://feross.org
Source: cMqyGFCQHk.exe, 00000000.00000003.2304404903.00000000057F0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://feross.org/opensource
Source: cMqyGFCQHk.exe, 00000000.00000003.2304404903.00000000057F0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://feross.org/support
Source: cMqyGFCQHk.exe, 00000000.00000003.2406552229.0000000006AF0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://fetch.spec.whatwg.org/
Source: cMqyGFCQHk.exe, 00000000.00000003.2406552229.0000000006AF0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://fetch.spec.whatwg.org/#fetch-method
Source: cMqyGFCQHk.exe, 00000000.00000003.2406552229.0000000006AF0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://fetch.spec.whatwg.org/#fetch-timing-info
Source: cMqyGFCQHk.exe, 00000000.00000003.2406552229.0000000006AF0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://fetch.spec.whatwg.org/#headers-class
Source: cMqyGFCQHk.exe, 00000000.00000003.2406552229.0000000006AF0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://fetch.spec.whatwg.org/#request-class
Source: cMqyGFCQHk.exe, 00000000.00000003.2406552229.0000000006AF0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://fetch.spec.whatwg.org/#response-class
Source: cMqyGFCQHk.exe, 00000000.00000003.2406552229.0000000006AF0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://gist.github.com/XVilka/8346728#gistcomment-2823421
Source: cMqyGFCQHk.exe, 00000000.00000003.2406552229.0000000006AF0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/ChromeDevTools/devtools-frontend/blob/4275917f84266ef40613db3c1784a25f902ea74e/fr
Source: cMqyGFCQHk.exe, 00000000.00000003.2293258093.0000000005CF0000.00000004.00001000.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2418539279.0000000005197000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/KhronosGroup/SPIRV-Headers
Source: cMqyGFCQHk.exe, 00000000.00000003.2293258093.0000000005CF0000.00000004.00001000.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2418539279.0000000005197000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/KhronosGroup/SPIRV-Headers.git
Source: cMqyGFCQHk.exe, 00000000.00000003.2293258093.0000000005CF0000.00000004.00001000.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2418539279.0000000005197000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/KhronosGroup/SPIRV-Tools
Source: cMqyGFCQHk.exe, 00000000.00000003.2293258093.0000000005CF0000.00000004.00001000.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2418539279.0000000005197000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/KhronosGroup/SPIRV-Tools.git
Source: cMqyGFCQHk.exe, 00000000.00000003.2293258093.0000000005CF0000.00000004.00001000.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2418539279.0000000005197000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/Maratyszcza/pthreadpool
Source: cMqyGFCQHk.exe, 00000000.00000003.2293258093.0000000005CF0000.00000004.00001000.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2418539279.0000000005197000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/Nicoshev/rapidhash
Source: cMqyGFCQHk.exe, 00000000.00000003.2293258093.0000000005CF0000.00000004.00001000.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2418539279.0000000005197000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/Nicoshev/rapidhash/blob/master/rapidhash.h
Source: cMqyGFCQHk.exe, 00000000.00000003.2293258093.0000000005CF0000.00000004.00001000.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2418539279.0000000005197000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/PortAudio/portaudio/tree/master/src/common
Source: cMqyGFCQHk.exe, 00000000.00000003.2293258093.0000000005CF0000.00000004.00001000.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2418539279.0000000005197000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/ReactiveX/rxjs
Source: cMqyGFCQHk.exe, 00000000.00000003.2304404903.00000000057F0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/RyanZim/universalify#readme
Source: cMqyGFCQHk.exe, 00000000.00000003.2304404903.00000000057F0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/RyanZim/universalify.git
Source: cMqyGFCQHk.exe, 00000000.00000003.2304404903.00000000057F0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/STRML/async-limiter
Source: cMqyGFCQHk.exe, 00000000.00000003.2304404903.00000000057F0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/Sebmaster/tr46.js#readme
Source: cMqyGFCQHk.exe, 00000000.00000003.2304404903.00000000057F0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/Sebmaster/tr46.js.git
Source: cMqyGFCQHk.exe, 00000000.00000003.2293258093.0000000005CF0000.00000004.00001000.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2418539279.0000000005197000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/SeleniumHQ/selenium/tree/trunk
Source: cMqyGFCQHk.exe, 00000000.00000003.2304404903.00000000057F0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/TooTallNate/util-deprecate
Source: cMqyGFCQHk.exe, 00000000.00000003.2304404903.00000000057F0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/TroyGoode)
Source: cMqyGFCQHk.exe, 00000000.00000003.2406907152.0000000006EF0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/WICG/construct-stylesheets/issues/119#issuecomment-588352418.
Source: cMqyGFCQHk.exe, 00000000.00000003.2406907152.0000000006EF0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/WICG/construct-stylesheets/issues/119#issuecomment-588352418.border-boxcontent-bo
Source: cMqyGFCQHk.exe, 00000000.00000003.2406907152.0000000006EF0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/WICG/scheduling-apis
Source: cMqyGFCQHk.exe, 00000000.00000003.2406907152.0000000006EF0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/WICG/shared-element-transitions/blob/main/debugging_overflow_on_images.md.
Source: cMqyGFCQHk.exe, 00000000.00000003.2406907152.0000000006EF0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/WICG/view-transitions/blob/main/debugging_overflow_on_images.md
Source: cMqyGFCQHk.exe, 00000000.00000003.2406552229.0000000006AF0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/WebAssembly/esm-integration/issues/42
Source: cMqyGFCQHk.exe, 00000000.00000003.2407447233.00000000073F3000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/WebBluetoothCG/web-bluetooth/blob/main/implementation-status.md
Source: cMqyGFCQHk.exe, 00000000.00000003.2293258093.0000000005CF0000.00000004.00001000.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2418539279.0000000005197000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/brailcom/speechd
Source: cMqyGFCQHk.exe, 00000000.00000003.2304404903.00000000057F0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/brycebaril/node-stream-meter.git
Source: cMqyGFCQHk.exe, 00000000.00000003.2304404903.00000000057F0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/calvinmetcalf/process-nextick-args
Source: cMqyGFCQHk.exe, 00000000.00000003.2304404903.00000000057F0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/calvinmetcalf/process-nextick-args.git
Source: cMqyGFCQHk.exe, 00000000.00000003.2406552229.0000000006AF0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/chalk/ansi-regex/blob/HEAD/index.js
Source: cMqyGFCQHk.exe, 00000000.00000003.2406552229.0000000006AF0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/chalk/supports-color
Source: cMqyGFCQHk.exe, 00000000.00000003.2304404903.00000000057F0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/chalk/wrap-ansi?sponsor=1
Source: cMqyGFCQHk.exe, 00000000.00000003.2406552229.0000000006AF0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/chromium/chromium/blob/HEAD/third_party/blink/public/platform/web_crypto_algorith
Source: cMqyGFCQHk.exe, 00000000.00000003.2304404903.00000000057F0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/conventional-changelog/standard-version):
Source: cMqyGFCQHk.exe, 00000000.00000003.2406552229.0000000006AF0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/da-x/rxvt-unicode/tree/v9.22-with-24bit-color
Source: cMqyGFCQHk.exe, 00000000.00000003.2406552229.0000000006AF0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/denoland/deno
Source: cMqyGFCQHk.exe, 00000000.00000003.2406552229.0000000006AF0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/denoland/deno/blob/main/LICENSE.md.
Source: cMqyGFCQHk.exe, 00000000.00000003.2406552229.0000000006AF0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/denoland/deno/blob/v1.29.1/ext/crypto/00_crypto.js#L195
Source: cMqyGFCQHk.exe, 00000000.00000003.2304404903.00000000057F0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/dominictarr/rc.git
Source: cMqyGFCQHk.exe, 00000000.00000003.2293258093.0000000005CF0000.00000004.00001000.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2418539279.0000000005197000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/etingof/pyasn1
Source: cMqyGFCQHk.exe, 00000000.00000003.2304404903.00000000057F0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/feross/queue-microtask
Source: cMqyGFCQHk.exe, 00000000.00000003.2304404903.00000000057F0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/feross/run-parallel
Source: cMqyGFCQHk.exe, 00000000.00000003.2304404903.00000000057F0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/feross/safe-buffer
Source: cMqyGFCQHk.exe, 00000000.00000003.2304404903.00000000057F0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/feross/simple-concat
Source: cMqyGFCQHk.exe, 00000000.00000003.2304404903.00000000057F0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/feross/simple-get
Source: cMqyGFCQHk.exe, 00000000.00000003.2304404903.00000000057F0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/fresc81/node-winreg
Source: cMqyGFCQHk.exe, 00000000.00000003.2406552229.0000000006AF0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/google/caja/blob/HEAD/src/com/google/caja/ses/repairES5.js
Source: cMqyGFCQHk.exe, 00000000.00000003.2406552229.0000000006AF0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/google/caja/blob/HEAD/src/com/google/caja/ses/startSES.js
Source: cMqyGFCQHk.exe, 00000000.00000003.2406552229.0000000006AF0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/google/closure-compiler/wiki/Source-Maps
Source: cMqyGFCQHk.exe, 00000000.00000003.2293258093.0000000005CF0000.00000004.00001000.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2418539279.0000000005197000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/google/pprof/tree/master/proto
Source: cMqyGFCQHk.exe, 00000000.00000003.2293258093.0000000005CF0000.00000004.00001000.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2418539279.0000000005197000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/google/private-join-and-compute
Source: cMqyGFCQHk.exe, 00000000.00000003.2293258093.0000000005CF0000.00000004.00001000.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2418539279.0000000005197000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/google/protobuf
Source: cMqyGFCQHk.exe, 00000000.00000003.2293258093.0000000005CF0000.00000004.00001000.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2418539279.0000000005197000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/google/re2
Source: cMqyGFCQHk.exe, 00000000.00000003.2293258093.0000000005CF0000.00000004.00001000.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2418539279.0000000005197000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/google/securemessage
Source: cMqyGFCQHk.exe, 00000000.00000003.2293258093.0000000005CF0000.00000004.00001000.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2418539279.0000000005197000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/google/sentencepiece
Source: cMqyGFCQHk.exe, 00000000.00000003.2293258093.0000000005CF0000.00000004.00001000.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2418539279.0000000005197000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/google/shell-encryption
Source: cMqyGFCQHk.exe, 00000000.00000003.2406552229.0000000006AF0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/heycam/webidl/pull/946.
Source: cMqyGFCQHk.exe, 00000000.00000003.2304404903.00000000057F0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/inspect-js/is-core-module
Source: cMqyGFCQHk.exe, 00000000.00000003.2304404903.00000000057F0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/inspect-js/is-core-module.git
Source: cMqyGFCQHk.exe, 00000000.00000003.2406552229.0000000006AF0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/inspect-js/is-date-object/blob/main/index.js#L3-L11
Source: cMqyGFCQHk.exe, 00000000.00000003.2304404903.00000000057F0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/inspect-js/node-supports-preserve-symlinks-flag#readme
Source: cMqyGFCQHk.exe, 00000000.00000003.2304404903.00000000057F0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/inspect-js/node-supports-preserve-symlinks-flag.git
Source: cMqyGFCQHk.exe, 00000000.00000003.2293258093.0000000005CF0000.00000004.00001000.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2418539279.0000000005197000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/intel/libva
Source: cMqyGFCQHk.exe, 00000000.00000003.2304404903.00000000057F0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/iojs/readable-stream/issues/101)
Source: cMqyGFCQHk.exe, 00000000.00000003.2304404903.00000000057F0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/iojs/readable-stream/issues/102)
Source: cMqyGFCQHk.exe, 00000000.00000003.2304404903.00000000057F0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/iojs/readable-stream/issues/105)
Source: cMqyGFCQHk.exe, 00000000.00000003.2304404903.00000000057F0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/iojs/readable-stream/issues/106
Source: cMqyGFCQHk.exe, 00000000.00000003.2304404903.00000000057F0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/iojs/readable-stream/issues/99)
Source: cMqyGFCQHk.exe, 00000000.00000003.2304404903.00000000057F0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/iojs/readable-stream/labels/wg-agenda
Source: cMqyGFCQHk.exe, 00000000.00000003.2406552229.0000000006AF0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/isaacs/color-support.
Source: cMqyGFCQHk.exe, 00000000.00000003.2304404903.00000000057F0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/jesec/pkg-fetch/actions/runs/2068737927
Source: cMqyGFCQHk.exe, 00000000.00000003.2304404903.00000000057F0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/jesec/pkg-fetch/actions/runs/2068738228
Source: cMqyGFCQHk.exe, 00000000.00000003.2304404903.00000000057F0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/jesec/pkg-fetch/actions/runs/2068738548
Source: cMqyGFCQHk.exe, 00000000.00000003.2304404903.00000000057F0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/jesec/pkg-fetch/actions/runs/2068742592
Source: cMqyGFCQHk.exe, 00000000.00000003.2304404903.00000000057F0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/jesec/pkg-fetch/actions/runs/2639071916
Source: cMqyGFCQHk.exe, 00000000.00000003.2304404903.00000000057F0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/jesec/pkg-fetch/actions/runs/2639072106
Source: cMqyGFCQHk.exe, 00000000.00000003.2304404903.00000000057F0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/jesec/pkg-fetch/actions/runs/2639072371
Source: cMqyGFCQHk.exe, 00000000.00000003.2304404903.00000000057F0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/jesec/pkg-fetch/actions/runs/2639072571
Source: cMqyGFCQHk.exe, 00000000.00000003.2304404903.00000000057F0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/jonschlinkert)
Source: cMqyGFCQHk.exe, 00000000.00000003.2304404903.00000000057F0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/joyent/node
Source: cMqyGFCQHk.exe, 00000000.00000003.2406552229.0000000006AF0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/joyent/node/issues/3295.
Source: cMqyGFCQHk.exe, 00000000.00000003.2304404903.00000000057F0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/jprichardson/node-fs-extra
Source: cMqyGFCQHk.exe, 00000000.00000003.2304404903.00000000057F0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/jprichardson/node-fs-extra/issues/269
Source: cMqyGFCQHk.exe, 00000000.00000003.2293258093.0000000005CF0000.00000004.00001000.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2418539279.0000000005197000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/jrmuizel/qcms/tree/v4
Source: cMqyGFCQHk.exe, 00000000.00000003.2406552229.0000000006AF0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/jsdom/webidl-conversions
Source: cMqyGFCQHk.exe, 00000000.00000003.2406552229.0000000006AF0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/jsdom/webidl-conversions/blob/master/LICENSE.md.
Source: cMqyGFCQHk.exe, 00000000.00000003.2304404903.00000000057F0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/lgeiger/node-abi/issues/54
Source: cMqyGFCQHk.exe, 00000000.00000003.2304404903.00000000057F0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/libuv/libuv/pull/1088
Source: cMqyGFCQHk.exe, 00000000.00000003.2406552229.0000000006AF0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/libuv/libuv/pull/1501.
Source: cMqyGFCQHk.exe, 00000000.00000003.2406552229.0000000006AF0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/libuv/libuv/pull/2025.
Source: cMqyGFCQHk.exe, 00000000.00000003.2304404903.00000000057F0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/ljharb)
Source: cMqyGFCQHk.exe, 00000000.00000003.2406552229.0000000006AF0000.00000004.00001000.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2304404903.00000000057F0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/mafintosh/end-of-stream
Source: cMqyGFCQHk.exe, 00000000.00000003.2406552229.0000000006AF0000.00000004.00001000.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2304404903.00000000057F0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/mafintosh/pump
Source: cMqyGFCQHk.exe, 00000000.00000003.2304404903.00000000057F0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/mafintosh/tar-fs
Source: cMqyGFCQHk.exe, 00000000.00000003.2304404903.00000000057F0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/mafintosh/tar-fs.git
Source: cMqyGFCQHk.exe, 00000000.00000003.2304404903.00000000057F0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/mafintosh/tar-stream
Source: cMqyGFCQHk.exe, 00000000.00000003.2304404903.00000000057F0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/mafintosh/tar-stream.git
Source: cMqyGFCQHk.exe, 00000000.00000003.2304404903.00000000057F0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/mcollina/reusify#readme
Source: cMqyGFCQHk.exe, 00000000.00000003.2304404903.00000000057F0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/mcollina/reusify.git
Source: cMqyGFCQHk.exe, 00000000.00000003.2304404903.00000000057F0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/micromatch/to-regex-range
Source: cMqyGFCQHk.exe, 00000000.00000003.2304404903.00000000057F0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/mikeal/tunnel-agent
Source: cMqyGFCQHk.exe, 00000000.00000003.2406552229.0000000006AF0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/mysticatea/abort-controller
Source: cMqyGFCQHk.exe, 00000000.00000003.2304404903.00000000057F0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/nodejs/TSC/blob/master/Moderation-Policy.md
Source: cMqyGFCQHk.exe, 00000000.00000003.2406552229.0000000006AF0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/nodejs/node-v0.x-archive/issues/2876.
Source: cMqyGFCQHk.exe, 00000000.00000003.2304404903.00000000057F0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/nodejs/node/blob/master/CODE_OF_CONDUCT.md
Source: cMqyGFCQHk.exe, 00000000.00000003.2304404903.00000000057F0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/nodejs/node/blob/v10.8.0/lib/internal/errors.js
Source: cMqyGFCQHk.exe, 00000000.00000003.2406552229.0000000006AF0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/nodejs/node/issues
Source: cMqyGFCQHk.exe, 00000000.00000003.2406552229.0000000006AF0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/nodejs/node/issues/10673
Source: cMqyGFCQHk.exe, 00000000.00000003.2406552229.0000000006AF0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/nodejs/node/issues/19009
Source: cMqyGFCQHk.exe, 00000000.00000003.2406552229.0000000006AF0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/nodejs/node/issues/2006
Source: cMqyGFCQHk.exe, 00000000.00000003.2406907152.0000000006EF0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/nodejs/node/issues/2119
Source: cMqyGFCQHk.exe, 00000000.00000003.2406552229.0000000006AF0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/nodejs/node/issues/3392
Source: cMqyGFCQHk.exe, 00000000.00000003.2406552229.0000000006AF0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/nodejs/node/issues/34532
Source: cMqyGFCQHk.exe, 00000000.00000003.2406552229.0000000006AF0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/nodejs/node/issues/35452
Source: cMqyGFCQHk.exe, 00000000.00000003.2406552229.0000000006AF0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/nodejs/node/issues/35475
Source: cMqyGFCQHk.exe, 00000000.00000003.2406552229.0000000006AF0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/nodejs/node/issues/35862
Source: cMqyGFCQHk.exe, 00000000.00000003.2406552229.0000000006AF0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/nodejs/node/issues/35981
Source: cMqyGFCQHk.exe, 00000000.00000003.2406552229.0000000006AF0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/nodejs/node/issues/39707
Source: cMqyGFCQHk.exe, 00000000.00000003.2406552229.0000000006AF0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/nodejs/node/issues/39758
Source: cMqyGFCQHk.exe, 00000000.00000003.2406552229.0000000006AF0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/nodejs/node/issues/44985
Source: cMqyGFCQHk.exe, 00000000.00000003.2406552229.0000000006AF0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/nodejs/node/issues/49472
Source: cMqyGFCQHk.exe, 00000000.00000003.2406552229.0000000006AF0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/nodejs/node/issues/51486
Source: cMqyGFCQHk.exe, 00000000.00000003.2406552229.0000000006AF0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/nodejs/node/issues/52219
Source: cMqyGFCQHk.exe, 00000000.00000003.2304404903.00000000057F0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/nodejs/node/issues/8871#issuecomment-250915913
Source: cMqyGFCQHk.exe, 00000000.00000003.2304404903.00000000057F0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/nodejs/node/issues/8987
Source: cMqyGFCQHk.exe, 00000000.00000003.2406552229.0000000006AF0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/nodejs/node/pull/12342
Source: cMqyGFCQHk.exe, 00000000.00000003.2406552229.0000000006AF0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/nodejs/node/pull/12607
Source: cMqyGFCQHk.exe, 00000000.00000003.2406552229.0000000006AF0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/nodejs/node/pull/13870#discussion_r124515293
Source: cMqyGFCQHk.exe, 00000000.00000003.2406907152.0000000006EF0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/nodejs/node/pull/1771#issuecomment-119351671
Source: cMqyGFCQHk.exe, 00000000.00000003.2406552229.0000000006AF0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/nodejs/node/pull/26334.
Source: cMqyGFCQHk.exe, 00000000.00000003.2406552229.0000000006AF0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/nodejs/node/pull/30380#issuecomment-552948364
Source: cMqyGFCQHk.exe, 00000000.00000003.2406552229.0000000006AF0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/nodejs/node/pull/33515.
Source: cMqyGFCQHk.exe, 00000000.00000003.2406552229.0000000006AF0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/nodejs/node/pull/33661
Source: cMqyGFCQHk.exe, 00000000.00000003.2406552229.0000000006AF0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/nodejs/node/pull/3394
Source: cMqyGFCQHk.exe, 00000000.00000003.2406552229.0000000006AF0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/nodejs/node/pull/34010
Source: cMqyGFCQHk.exe, 00000000.00000003.2406552229.0000000006AF0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/nodejs/node/pull/34103#issuecomment-652002364
Source: cMqyGFCQHk.exe, 00000000.00000003.2406552229.0000000006AF0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/nodejs/node/pull/34375
Source: cMqyGFCQHk.exe, 00000000.00000003.2406552229.0000000006AF0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/nodejs/node/pull/34385
Source: cMqyGFCQHk.exe, 00000000.00000003.2406907152.0000000006EF0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/nodejs/node/pull/35407#issuecomment-700693439
Source: cMqyGFCQHk.exe, 00000000.00000003.2406552229.0000000006AF0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/nodejs/node/pull/35949#issuecomment-722496598
Source: cMqyGFCQHk.exe, 00000000.00000003.2406552229.0000000006AF0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/nodejs/node/pull/36061#discussion_r533718029
Source: cMqyGFCQHk.exe, 00000000.00000003.2406552229.0000000006AF0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/nodejs/node/pull/38248
Source: cMqyGFCQHk.exe, 00000000.00000003.2406552229.0000000006AF0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/nodejs/node/pull/38614)
Source: cMqyGFCQHk.exe, 00000000.00000003.2406552229.0000000006AF0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/nodejs/node/pull/43714
Source: cMqyGFCQHk.exe, 00000000.00000003.2406552229.0000000006AF0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/nodejs/node/pull/46161
Source: cMqyGFCQHk.exe, 00000000.00000003.2406552229.0000000006AF0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/nodejs/node/pull/48477#issuecomment-1604586650
Source: cMqyGFCQHk.exe, 00000000.00000003.2406552229.0000000006AF0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/nodejs/node/pull/49891#issuecomment-1744673430.
Source: cMqyGFCQHk.exe, 00000000.00000003.2304404903.00000000057F0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/nodejs/string_decoder
Source: cMqyGFCQHk.exe, 00000000.00000003.2304404903.00000000057F0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/normalize/mz
Source: cMqyGFCQHk.exe, 00000000.00000003.2304404903.00000000057F0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/npm/cli/blob/4c65cd952bc8627811735bea76b9b110cc4fc80e/lib/utils/ansi-trim.js
Source: cMqyGFCQHk.exe, 00000000.00000003.2304404903.00000000057F0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/npm/node-semver.git
Source: cMqyGFCQHk.exe, 00000000.00000003.2304404903.00000000057F0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/npm/node-tar/blob/51b6627a1f357d2eb433e7378e5f05e83b7aa6cd/lib/header.js#L349
Source: cMqyGFCQHk.exe, 00000000.00000003.2304404903.00000000057F0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/npm/wrappy
Source: cMqyGFCQHk.exe, 00000000.00000003.2304404903.00000000057F0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/prebuild/prebuild-install
Source: cMqyGFCQHk.exe, 00000000.00000003.2304404903.00000000057F0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/prebuild/prebuild-install.git
Source: cMqyGFCQHk.exe, 00000000.00000003.2293258093.0000000005CF0000.00000004.00001000.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2418539279.0000000005197000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/protocolbuffers/protobuf-javascript
Source: cMqyGFCQHk.exe, 00000000.00000003.2293258093.0000000005CF0000.00000004.00001000.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2418539279.0000000005197000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/protocolbuffers/protobuf/blob/master/java/lite.md
Source: cMqyGFCQHk.exe, 00000000.00000003.2293258093.0000000005CF0000.00000004.00001000.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2418539279.0000000005197000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/puppeteer/puppeteer/tree/main/packages/puppeteer-core
Source: cMqyGFCQHk.exe, 00000000.00000003.2304404903.00000000057F0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/sass/node-sass/issues/1589#issuecomment-265292579
Source: cMqyGFCQHk.exe, 00000000.00000003.2293258093.0000000005CF0000.00000004.00001000.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2418539279.0000000005197000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/simplejson/simplejson
Source: cMqyGFCQHk.exe, 00000000.00000003.2304404903.00000000057F0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/sindresorhus/make-dir
Source: cMqyGFCQHk.exe, 00000000.00000003.2304404903.00000000057F0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/sindresorhus/os-homedir/blob/11e089f4754db38bb535e5a8416320c4446e8cfd/index.js
Source: cMqyGFCQHk.exe, 00000000.00000003.2406552229.0000000006AF0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/sinonjs/fake-timers/blob/a4c757f80840829e45e0852ea1b17d87a998388e/src/fake-timers
Source: cMqyGFCQHk.exe, 00000000.00000003.2304404903.00000000057F0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/sponsors/broofa
Source: cMqyGFCQHk.exe, 00000000.00000003.2304404903.00000000057F0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/sponsors/ctavan
Source: cMqyGFCQHk.exe, 00000000.00000003.2304404903.00000000057F0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/sponsors/feross
Source: cMqyGFCQHk.exe, 00000000.00000003.2304404903.00000000057F0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/sponsors/ljharb
Source: cMqyGFCQHk.exe, 00000000.00000003.2406552229.0000000006AF0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/standard-things/esm/issues/821.
Source: cMqyGFCQHk.exe, 00000000.00000003.2406552229.0000000006AF0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/tc39/ecma262/blob/HEAD/LICENSE.md
Source: cMqyGFCQHk.exe, 00000000.00000003.2406552229.0000000006AF0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/tc39/ecma262/issues/1209
Source: cMqyGFCQHk.exe, 00000000.00000003.2406552229.0000000006AF0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/tc39/proposal-iterator-helpers/issues/169
Source: cMqyGFCQHk.exe, 00000000.00000003.2406552229.0000000006AF0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/tc39/proposal-ses/blob/e5271cc42a257a05dcae2fd94713ed2f46c08620/shim/src/freeze.j
Source: cMqyGFCQHk.exe, 00000000.00000003.2406552229.0000000006AF0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/tc39/proposal-weakrefs
Source: cMqyGFCQHk.exe, 00000000.00000003.2304404903.00000000057F0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/troygoode/node-require-directory/
Source: cMqyGFCQHk.exe, 00000000.00000003.2304404903.00000000057F0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/uuidjs/uuid#getrandomvalues-not-supported
Source: cMqyGFCQHk.exe, 00000000.00000003.2304404903.00000000057F0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/uuidjs/uuid.git
Source: cMqyGFCQHk.exe, 00000000.00000003.2304404903.00000000057F0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/v8/v8/blob/6.0.122/test/mjsunit/fast-prototype.js#L48-L63
Source: cMqyGFCQHk.exe, 00000000.00000003.2304404903.00000000057F0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/vercel/pkg-fetch/actions/runs/2068735040
Source: cMqyGFCQHk.exe, 00000000.00000003.2304404903.00000000057F0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/vercel/pkg-fetch/actions/runs/2068735307
Source: cMqyGFCQHk.exe, 00000000.00000003.2304404903.00000000057F0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/vercel/pkg-fetch/actions/runs/2068735697
Source: cMqyGFCQHk.exe, 00000000.00000003.2304404903.00000000057F0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/vercel/pkg-fetch/actions/runs/2068736093
Source: cMqyGFCQHk.exe, 00000000.00000003.2304404903.00000000057F0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/vercel/pkg-fetch/actions/runs/2068736404
Source: cMqyGFCQHk.exe, 00000000.00000003.2304404903.00000000057F0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/vercel/pkg-fetch/actions/runs/2638965835
Source: cMqyGFCQHk.exe, 00000000.00000003.2304404903.00000000057F0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/vercel/pkg-fetch/actions/runs/2638965968
Source: cMqyGFCQHk.exe, 00000000.00000003.2304404903.00000000057F0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/vercel/pkg-fetch/actions/runs/2638966056
Source: cMqyGFCQHk.exe, 00000000.00000003.2304404903.00000000057F0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/vercel/pkg-fetch/actions/runs/2638966247
Source: cMqyGFCQHk.exe, 00000000.00000003.2304404903.00000000057F0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/vercel/pkg-fetch/actions/runs/2638966552
Source: cMqyGFCQHk.exe, 00000000.00000003.2304404903.00000000057F0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/vercel/pkg-fetch/actions/runs/752615021
Source: cMqyGFCQHk.exe, 00000000.00000003.2304404903.00000000057F0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/vercel/pkg-fetch/actions/runs/752615173
Source: cMqyGFCQHk.exe, 00000000.00000003.2304404903.00000000057F0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/vercel/pkg-fetch/actions/runs/752615423
Source: cMqyGFCQHk.exe, 00000000.00000003.2304404903.00000000057F0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/vercel/pkg-fetch/actions/runs/752615557
Source: cMqyGFCQHk.exe, 00000000.00000003.2304404903.00000000057F0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/vercel/pkg-fetch/actions/runs/752615807
Source: cMqyGFCQHk.exe, 00000000.00000003.2304404903.00000000057F0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/vercel/pkg-fetch/actions/runs/888438143
Source: cMqyGFCQHk.exe, 00000000.00000003.2304404903.00000000057F0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/vercel/pkg-fetch/actions/runs/888438190
Source: cMqyGFCQHk.exe, 00000000.00000003.2304404903.00000000057F0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/vercel/pkg-fetch/actions/runs/888438236
Source: cMqyGFCQHk.exe, 00000000.00000003.2304404903.00000000057F0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/vercel/pkg-fetch/actions/runs/918633749
Source: cMqyGFCQHk.exe, 00000000.00000003.2304404903.00000000057F0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/vercel/pkg-fetch/releases/download/
Source: cMqyGFCQHk.exe, 00000000.00000003.2406907152.0000000006EF0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/w3c/csswg-drafts/issues/4805
Source: cMqyGFCQHk.exe, 00000000.00000003.2406907152.0000000006EF0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/w3c/csswg-drafts/issues/4805Custom
Source: cMqyGFCQHk.exe, 00000000.00000003.2406907152.0000000006EF0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/w3c/gamepad/pull/120
Source: cMqyGFCQHk.exe, 00000000.00000003.2406907152.0000000006EF0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/w3c/gamepad/pull/120Access
Source: cMqyGFCQHk.exe, 00000000.00000003.2406907152.0000000006EF0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/w3c/webappsec-permissions-policy/blob/master/features.md#sensor-features
Source: cMqyGFCQHk.exe, 00000000.00000003.2406907152.0000000006EF0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/w3c/webappsec-permissions-policy/blob/master/features.md#sensor-featuresDeviceOri
Source: cMqyGFCQHk.exe, 00000000.00000003.2304404903.00000000057F0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/websockets/ws
Source: cMqyGFCQHk.exe, 00000000.00000003.2304404903.00000000057F0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/websockets/ws.git
Source: cMqyGFCQHk.exe, 00000000.00000003.2304404903.00000000057F0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/websockets/ws/issues/1202
Source: cMqyGFCQHk.exe, 00000000.00000003.2304404903.00000000057F0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/websockets/ws/issues/1869.
Source: cMqyGFCQHk.exe, 00000000.00000003.2304404903.00000000057F0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/websockets/ws/issues/1940.
Source: cMqyGFCQHk.exe, 00000000.00000003.2293258093.0000000005CF0000.00000004.00001000.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2418539279.0000000005197000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/xiph/rnnoise
Source: cMqyGFCQHk.exe, 00000000.00000003.2304404903.00000000057F0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/yargs/y18n
Source: cMqyGFCQHk.exe, 00000000.00000003.2304404903.00000000057F0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/yargs/yargs#supported-nodejs-versions
Source: cMqyGFCQHk.exe, 00000000.00000003.2304404903.00000000057F0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/yargs/yargs-parser#supported-nodejs-versions
Source: cMqyGFCQHk.exe, 00000000.00000003.2304404903.00000000057F0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/yargs/yargs-parser.git
Source: cMqyGFCQHk.exe, 00000000.00000003.2304404903.00000000057F0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/yargs/yargs.git
Source: cMqyGFCQHk.exe, 00000000.00000003.2293258093.0000000005CF0000.00000004.00001000.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2418539279.0000000005197000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/zorkow/speech-rule-user
Source: cMqyGFCQHk.exe, 00000000.00000003.2407447233.00000000073F3000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://goo.gl/4NeimX
Source: cMqyGFCQHk.exe, 00000000.00000003.2407447233.00000000073F3000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://goo.gl/4NeimXAccess
Source: cMqyGFCQHk.exe, 00000000.00000003.2407447233.00000000073F3000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://goo.gl/4NeimXOrigin
Source: cMqyGFCQHk.exe, 00000000.00000003.2407447233.00000000073F3000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://goo.gl/4NeimXgetDescriptor(s)
Source: cMqyGFCQHk.exe, 00000000.00000003.2407447233.00000000073F3000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://goo.gl/4NeimXreadValue()
Source: cMqyGFCQHk.exe, 00000000.00000003.2407447233.00000000073F3000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://goo.gl/4NeimXwriteValue()
Source: cMqyGFCQHk.exe, 00000000.00000003.2407447233.00000000073F3000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://goo.gl/EuHzyv
Source: cMqyGFCQHk.exe, 00000000.00000003.2407447233.00000000073F3000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://goo.gl/HxfxSQ
Source: cMqyGFCQHk.exe, 00000000.00000003.2407447233.00000000073F3000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://goo.gl/HxfxSQOrigin
Source: cMqyGFCQHk.exe, 00000000.00000003.2407447233.00000000073F3000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://goo.gl/HxfxSQrequestDevice()
Source: cMqyGFCQHk.exe, 00000000.00000003.2407447233.00000000073F3000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://goo.gl/J6ASzs
Source: cMqyGFCQHk.exe, 00000000.00000003.2407447233.00000000073F3000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://goo.gl/J6ASzsBluetooth
Source: cMqyGFCQHk.exe, 00000000.00000003.2406907152.0000000006EF0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://goo.gl/LdLk22
Source: cMqyGFCQHk.exe, 00000000.00000003.2406907152.0000000006EF0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://goo.gl/LdLk22Media
Source: cMqyGFCQHk.exe, 00000000.00000003.2406907152.0000000006EF0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://goo.gl/LdLk22RemoveElementFromDocumentMapit
Source: cMqyGFCQHk.exe, 00000000.00000003.2406907152.0000000006EF0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://goo.gl/t5IS6M).
Source: cMqyGFCQHk.exe, 00000000.00000003.2406907152.0000000006EF0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://goo.gle/chrome-insecure-origins
Source: cMqyGFCQHk.exe, 00000000.00000003.2407447233.00000000073F3000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://google.com/pay
Source: cMqyGFCQHk.exe, 00000000.00000003.2304404903.00000000057F0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://hackerone.com/reports/541502
Source: cMqyGFCQHk.exe, 00000000.00000003.2406552229.0000000006AF0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://heycam.github.io/webidl/#define-the-operations
Source: cMqyGFCQHk.exe, 00000000.00000003.2406552229.0000000006AF0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://heycam.github.io/webidl/#dfn-default-iterator-object
Source: cMqyGFCQHk.exe, 00000000.00000003.2406552229.0000000006AF0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://heycam.github.io/webidl/#dfn-iterator-prototype-object
Source: cMqyGFCQHk.exe, 00000000.00000003.2406552229.0000000006AF0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://heycam.github.io/webidl/#es-interfaces
Source: cMqyGFCQHk.exe, 00000000.00000003.2406552229.0000000006AF0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://heycam.github.io/webidl/#es-iterable
Source: cMqyGFCQHk.exe, 00000000.00000003.2406552229.0000000006AF0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://heycam.github.io/webidl/#es-iterable-entries
Source: cMqyGFCQHk.exe, 00000000.00000003.2406552229.0000000006AF0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://heycam.github.io/webidl/#es-iterators
Source: cMqyGFCQHk.exe, 00000000.00000003.2406552229.0000000006AF0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://heycam.github.io/webidl/#es-namespaces
Source: cMqyGFCQHk.exe, 00000000.00000003.2406552229.0000000006AF0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://heycam.github.io/webidl/#es-stringifier
Source: cMqyGFCQHk.exe, 00000000.00000003.2304404903.00000000057F0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://html.spec.whatwg.org/multipage/comms.html#the-websocket-interface
Source: cMqyGFCQHk.exe, 00000000.00000003.2406552229.0000000006AF0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://html.spec.whatwg.org/multipage/server-sent-events.html
Source: cMqyGFCQHk.exe, 00000000.00000003.2406552229.0000000006AF0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://html.spec.whatwg.org/multipage/server-sent-events.html#server-sent-events.org/
Source: cMqyGFCQHk.exe, 00000000.00000003.2406907152.0000000006EF0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://html.spec.whatwg.org/multipage/timers-and-user-prompts.html#dom-setinterval
Source: cMqyGFCQHk.exe, 00000000.00000003.2406552229.0000000006AF0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://html.spec.whatwg.org/multipage/web-messaging.html#broadcasting-to-other-browsing-contexts
Source: cMqyGFCQHk.exe, 00000000.00000003.2406552229.0000000006AF0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://html.spec.whatwg.org/multipage/webappapis.html#windoworworkerglobalscope
Source: cMqyGFCQHk.exe, 00000000.00000003.2406552229.0000000006AF0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://html.spec.whatwg.org/multipage/webappapis.html#windoworworkerglobalscope.
Source: cMqyGFCQHk.exe, 00000000.00000003.2406552229.0000000006AF0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://invisible-island.net/ncurses/terminfo.ti.html#toc-_Specials
Source: cMqyGFCQHk.exe, 00000000.00000003.2406552229.0000000006AF0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://linux.die.net/man/1/dircolors).
Source: cMqyGFCQHk.exe, 00000000.00000003.2406552229.0000000006AF0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://ltp.sourceforge.net/coverage/lcov/geninfo.1.php
Source: cMqyGFCQHk.exe, 00000000.00000003.2406907152.0000000006EF0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://mathiasbynens.be/notes/javascript-encoding
Source: cMqyGFCQHk.exe, 00000000.00000003.2304404903.00000000057F0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://medium.com/
Source: cMqyGFCQHk.exe, 00000000.00000003.2406552229.0000000006AF0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://no-color.org/
Source: cMqyGFCQHk.exe, 00000000.00000003.2304404903.00000000057F0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://nodei.co/npm/require-directory.png?downloads=true&stars=true)
Source: cMqyGFCQHk.exe, 00000000.00000003.2304404903.00000000057F0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://nodei.co/npm/require-directory/)
Source: cMqyGFCQHk.exe, 00000000.00000003.2406552229.0000000006AF0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://nodejs.org/
Source: cMqyGFCQHk.exe, 00000000.00000003.2406552229.0000000006AF0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://nodejs.org/api/cli.html#cli_unhandled_rejections_mode).
Source: cMqyGFCQHk.exe, 00000000.00000003.2406552229.0000000006AF0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://nodejs.org/api/fs.html
Source: cMqyGFCQHk.exe, 00000000.00000003.2406552229.0000000006AF0000.00000004.00001000.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2304404903.00000000057F0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://nodejs.org/api/fs.html#fs_stat_time_values)
Source: cMqyGFCQHk.exe, 00000000.00000003.2406552229.0000000006AF0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://nodejs.org/api/permissions.html#file-system-permissions
Source: cMqyGFCQHk.exe, 00000000.00000003.2304404903.00000000057F0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://nodejs.org/dist
Source: cMqyGFCQHk.exe, 00000000.00000003.2304404903.00000000057F0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://npmjs.org/package/require-directory))
Source: cMqyGFCQHk.exe, 00000000.00000003.2479386329.0000000004C34000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2478846758.0000000004C34000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://passwords.google.comGoogle
Source: cMqyGFCQHk.exe, 00000000.00000003.2480625633.0000000004C34000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://passwords.google.comKonta
Source: cMqyGFCQHk.exe, 00000000.00000003.2407447233.00000000073F3000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://pay.google.com/authentication
Source: cMqyGFCQHk.exe, 00000000.00000003.2407447233.00000000073F3000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://play.google.com/billing
Source: cMqyGFCQHk.exe, 00000000.00000003.2407447233.00000000073F3000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://play.google.com/billinghttps://google.com/payhttps://android.com/payhttps://pay.google.com/a
Source: cMqyGFCQHk.exe, 00000000.00000003.2293258093.0000000005CF0000.00000004.00001000.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2418539279.0000000005197000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://polymer-library.polymer-project.org
Source: cMqyGFCQHk.exe, 00000000.00000003.2406552229.0000000006AF0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://pubs.opengroup.org/onlinepubs/9699919799/basedefs/V1_chap12.html
Source: cMqyGFCQHk.exe, 00000000.00000003.2406552229.0000000006AF0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://pubs.opengroup.org/onlinepubs/9699919799/basedefs/V1_chap12.html).
Source: cMqyGFCQHk.exe, 00000000.00000003.2293258093.0000000005CF0000.00000004.00001000.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2418539279.0000000005197000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://pypi.org/project/pyparsing
Source: cMqyGFCQHk.exe, 00000000.00000003.2293258093.0000000005CF0000.00000004.00001000.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2418539279.0000000005197000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://pypi.org/project/six/
Source: cMqyGFCQHk.exe, 00000000.00000003.2293258093.0000000005CF0000.00000004.00001000.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2418539279.0000000005197000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://pypi.python.org/pypi/pyfakefs
Source: cMqyGFCQHk.exe, 00000000.00000003.2293258093.0000000005CF0000.00000004.00001000.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2418539279.0000000005197000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://quiche.googlesource.com/quiche
Source: cMqyGFCQHk.exe, 00000000.00000003.2293258093.0000000005CF0000.00000004.00001000.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2418539279.0000000005197000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://redux.js.org/
Source: cMqyGFCQHk.exe, 00000000.00000003.2304404903.00000000057F0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://secure.travis-ci.org/troygoode/node-require-directory.png)
Source: cMqyGFCQHk.exe, 00000000.00000003.2304404903.00000000057F0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://semver.org/
Source: cMqyGFCQHk.exe, 00000000.00000003.2304404903.00000000057F0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://sindresorhus.com
Source: cMqyGFCQHk.exe, 00000000.00000003.2304404903.00000000057F0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://sindresorhus.com)
Source: cMqyGFCQHk.exe, 00000000.00000003.2293258093.0000000005CF0000.00000004.00001000.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2418539279.0000000005197000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://sites.google.com/site/gaviotachessuser/Home/endgame-tablebases-1
Source: cMqyGFCQHk.exe, 00000000.00000003.2293258093.0000000005CF0000.00000004.00001000.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2418539279.0000000005197000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://sizzlejs.com/
Source: cMqyGFCQHk.exe, 00000000.00000003.2293258093.0000000005CF0000.00000004.00001000.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2418539279.0000000005197000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://skia.org/
Source: cMqyGFCQHk.exe, 00000000.00000003.2406552229.0000000006AF0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://sourcemaps.info/spec.html
Source: cMqyGFCQHk.exe, 00000000.00000003.2406552229.0000000006AF0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://stackoverflow.com/a/5501711/3561
Source: cMqyGFCQHk.exe, 00000000.00000003.2406552229.0000000006AF0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://streams.spec.whatwg.org/#example-manual-write-with-backpressure
Source: cMqyGFCQHk.exe, 00000000.00000003.2406552229.0000000006AF0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://streams.spec.whatwg.org/#example-rbs-pull
Source: cMqyGFCQHk.exe, 00000000.00000003.2479386329.0000000004C34000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2479792300.0000000004C34000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2478846758.0000000004C34000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2481225639.0000000004C34000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2478185118.0000000004C34000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2480146293.0000000004C34000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2481468216.0000000004C34000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2477975318.0000000004C34000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2478464913.0000000004C34000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://support.google.com/chrome/a/answer/9122284
Source: cMqyGFCQHk.exe, 00000000.00000003.2479386329.0000000004C34000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2479792300.0000000004C34000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2480625633.0000000004C34000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2478846758.0000000004C34000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2481225639.0000000004C34000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2478185118.0000000004C34000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2480146293.0000000004C34000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2481468216.0000000004C34000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2477975318.0000000004C34000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2478464913.0000000004C34000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://support.google.com/chrome/answer/6098869
Source: cMqyGFCQHk.exe, 00000000.00000003.2406552229.0000000006AF0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://tc39.es/ecma262/#eqn-modulo
Source: cMqyGFCQHk.exe, 00000000.00000003.2406552229.0000000006AF0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://tc39.es/ecma262/#sec-%typedarray%-intrinsic-object
Source: cMqyGFCQHk.exe, 00000000.00000003.2406552229.0000000006AF0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://tc39.es/ecma262/#sec-HostLoadImportedModule.
Source: cMqyGFCQHk.exe, 00000000.00000003.2406552229.0000000006AF0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://tc39.es/ecma262/#sec-IsHTMLDDA-internal-slot
Source: cMqyGFCQHk.exe, 00000000.00000003.2406552229.0000000006AF0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://tc39.es/ecma262/#sec-timeclip
Source: cMqyGFCQHk.exe, 00000000.00000003.2406552229.0000000006AF0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://tc39.es/ecma262/#sec-tonumber
Source: cMqyGFCQHk.exe, 00000000.00000003.2406552229.0000000006AF0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://tc39.es/ecma262/#table-typeof-operator-results
Source: cMqyGFCQHk.exe, 00000000.00000003.2406552229.0000000006AF0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://tc39.github.io/ecma262/#sec-object.prototype.tostring
Source: cMqyGFCQHk.exe, 00000000.00000003.2304404903.00000000057F0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://tidelift.com/security
Source: cMqyGFCQHk.exe, 00000000.00000003.2304404903.00000000057F0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://tidelift.com/security).
Source: cMqyGFCQHk.exe, 00000000.00000003.2406552229.0000000006AF0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://tools.ietf.org/html/rfc2397#section-2
Source: cMqyGFCQHk.exe, 00000000.00000003.2406907152.0000000006EF0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://tools.ietf.org/html/rfc3492#section-3.4
Source: cMqyGFCQHk.exe, 00000000.00000003.2406552229.0000000006AF0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://tools.ietf.org/html/rfc6455#section-1.3
Source: cMqyGFCQHk.exe, 00000000.00000003.2304404903.00000000057F0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://tools.ietf.org/html/rfc6455#section-9.1
Source: cMqyGFCQHk.exe, 00000000.00000003.2406552229.0000000006AF0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://tools.ietf.org/html/rfc7230#section-3.2.2
Source: cMqyGFCQHk.exe, 00000000.00000003.2406552229.0000000006AF0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://tools.ietf.org/html/rfc7540#section-8.1.2.5
Source: cMqyGFCQHk.exe, 00000000.00000003.2304404903.00000000057F0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://twitter.com/intent/user?screen_name=troygoode)
Source: cMqyGFCQHk.exe, 00000000.00000003.2304404903.00000000057F0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://unpkg.com/cliui
Source: cMqyGFCQHk.exe, 00000000.00000003.2304404903.00000000057F0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://unpkg.com/yargs-parser
Source: cMqyGFCQHk.exe, 00000000.00000003.2406552229.0000000006AF0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://url.spec.whatwg.org/#concept-url
Source: cMqyGFCQHk.exe, 00000000.00000003.2304404903.00000000057F0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://url.spec.whatwg.org/#concept-url-origin
Source: cMqyGFCQHk.exe, 00000000.00000003.2406552229.0000000006AF0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://url.spec.whatwg.org/#concept-urlencoded-byte-serializer
Source: cMqyGFCQHk.exe, 00000000.00000003.2406552229.0000000006AF0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://url.spec.whatwg.org/#concept-urlencoded-parser
Source: cMqyGFCQHk.exe, 00000000.00000003.2406552229.0000000006AF0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://url.spec.whatwg.org/#concept-urlencoded-serializer
Source: cMqyGFCQHk.exe, 00000000.00000003.2406552229.0000000006AF0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://url.spec.whatwg.org/#dom-urlsearchparams-urlsearchparams
Source: cMqyGFCQHk.exe, 00000000.00000003.2406907152.0000000006EF0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://url.spec.whatwg.org/#forbidden-host-code-point
Source: cMqyGFCQHk.exe, 00000000.00000003.2406552229.0000000006AF0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://url.spec.whatwg.org/#special-scheme
Source: cMqyGFCQHk.exe, 00000000.00000003.2406552229.0000000006AF0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://url.spec.whatwg.org/#url
Source: cMqyGFCQHk.exe, 00000000.00000003.2406552229.0000000006AF0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://url.spec.whatwg.org/#urlsearchparams
Source: cMqyGFCQHk.exe, 00000000.00000003.2406552229.0000000006AF0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://url.spec.whatwg.org/#urlsearchparams-stringification-behavior
Source: cMqyGFCQHk.exe, 00000000.00000003.2406552229.0000000006AF0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://v8.dev/docs/stack-trace-api#customizing-stack-traces.
Source: cMqyGFCQHk.exe, 00000000.00000003.2406552229.0000000006AF0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://v8.dev/docs/stack-trace-api.
Source: cMqyGFCQHk.exe, 00000000.00000003.2406552229.0000000006AF0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://w3c.github.io/FileAPI/#creating-revoking
Source: cMqyGFCQHk.exe, 00000000.00000003.2406907152.0000000006EF0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://w3c.github.io/aria/#aria-hidden.
Source: cMqyGFCQHk.exe, 00000000.00000003.2406907152.0000000006EF0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://w3c.github.io/aria/#aria-hidden.Blocked
Source: cMqyGFCQHk.exe, 00000000.00000003.2407447233.00000000073F3000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://w3c.github.io/manifest/#installability-signals
Source: cMqyGFCQHk.exe, 00000000.00000003.2407447233.00000000073F3000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://w3c.github.io/manifest/#installability-signals0
Source: cMqyGFCQHk.exe, 00000000.00000003.2406552229.0000000006AF0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://w3c.github.io/resource-timing/#dfn-mark-resource-timing
Source: cMqyGFCQHk.exe, 00000000.00000003.2406552229.0000000006AF0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://w3c.github.io/resource-timing/#dfn-setup-the-resource-timing-entry
Source: cMqyGFCQHk.exe, 00000000.00000003.2406552229.0000000006AF0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://w3c.github.io/resource-timing/#dom-performance-setresourcetimingbuffersize
Source: cMqyGFCQHk.exe, 00000000.00000003.2406907152.0000000006EF0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://w3c.github.io/uievents/#legacy-event-types)
Source: cMqyGFCQHk.exe, 00000000.00000003.2406552229.0000000006AF0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://w3c.github.io/webappsec-subresource-integrity/#the-integrity-attribute
Source: cMqyGFCQHk.exe, 00000000.00000003.2406552229.0000000006AF0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://w3c.github.io/webcrypto/#SubtleCrypto-method-wrapKey
Source: cMqyGFCQHk.exe, 00000000.00000003.2406552229.0000000006AF0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://w3c.github.io/webcrypto/#algorithm-normalization-normalize-an-algorithm
Source: cMqyGFCQHk.exe, 00000000.00000003.2406552229.0000000006AF0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://webidl.spec.whatwg.org/#Exposed
Source: cMqyGFCQHk.exe, 00000000.00000003.2406552229.0000000006AF0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://webidl.spec.whatwg.org/#Exposed.
Source: cMqyGFCQHk.exe, 00000000.00000003.2406552229.0000000006AF0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://webidl.spec.whatwg.org/#abstract-opdef-converttoint
Source: cMqyGFCQHk.exe, 00000000.00000003.2406552229.0000000006AF0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://webidl.spec.whatwg.org/#abstract-opdef-integerpart
Source: cMqyGFCQHk.exe, 00000000.00000003.2406552229.0000000006AF0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://webidl.spec.whatwg.org/#es-DOMString
Source: cMqyGFCQHk.exe, 00000000.00000003.2406552229.0000000006AF0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://webidl.spec.whatwg.org/#es-dictionary
Source: cMqyGFCQHk.exe, 00000000.00000003.2406552229.0000000006AF0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://webidl.spec.whatwg.org/#es-invoking-callback-functions
Source: cMqyGFCQHk.exe, 00000000.00000003.2406552229.0000000006AF0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://websockets.spec.whatwg.org/
Source: cMqyGFCQHk.exe, 00000000.00000003.2293258093.0000000005CF0000.00000004.00001000.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2418539279.0000000005197000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.apache.org/licenses/
Source: cMqyGFCQHk.exe, 00000000.00000003.2293258093.0000000005CF0000.00000004.00001000.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2418539279.0000000005197000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.apache.org/licenses/LICENSE-2.0
Source: cMqyGFCQHk.exe, 00000000.00000003.2407447233.00000000073F3000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.bluetooth.com/specifications/gatt/characteristics
Source: cMqyGFCQHk.exe, 00000000.00000003.2407447233.00000000073F3000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.bluetooth.com/specifications/gatt/descriptors
Source: cMqyGFCQHk.exe, 00000000.00000003.2407447233.00000000073F3000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.bluetooth.com/specifications/gatt/services
Source: cMqyGFCQHk.exe, 00000000.00000003.2407447233.00000000073F3000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.chromestatus.com/feature/5093566007214080
Source: cMqyGFCQHk.exe, 00000000.00000003.2407447233.00000000073F3000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.chromestatus.com/feature/5093566007214080ErrorEventInit
Source: cMqyGFCQHk.exe, 00000000.00000003.2407447233.00000000073F3000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.chromestatus.com/feature/5636954674692096
Source: cMqyGFCQHk.exe, 00000000.00000003.2407447233.00000000073F3000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.chromestatus.com/feature/5644273861001216.
Source: cMqyGFCQHk.exe, 00000000.00000003.2407447233.00000000073F3000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.chromestatus.com/feature/5682658461876224.
Source: cMqyGFCQHk.exe, 00000000.00000003.2407447233.00000000073F3000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.chromestatus.com/feature/5718547946799104
Source: cMqyGFCQHk.exe, 00000000.00000003.2406907152.0000000006EF0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.chromestatus.com/feature/5738264052891648
Source: cMqyGFCQHk.exe, 00000000.00000003.2406907152.0000000006EF0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.chromestatus.com/feature/5738264052891648Renderer.Font.PrimaryFont.FCPRenderer.Font.Prim
Source: cMqyGFCQHk.exe, 00000000.00000003.2407447233.00000000073F3000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.chromestatus.com/feature/6662647093133312
Source: cMqyGFCQHk.exe, 00000000.00000003.2407447233.00000000073F3000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.chromestatus.com/feature/6662647093133312InputDeviceCapabilities
Source: cMqyGFCQHk.exe, 00000000.00000003.2304404903.00000000057F0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.cl.cam.ac.uk/%7Emgk25/ucs/utf8_check.c
Source: cMqyGFCQHk.exe, 00000000.00000003.2406552229.0000000006AF0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.ecma-international.org/ecma-262/#sec-line-terminators
Source: cMqyGFCQHk.exe, 00000000.00000003.2406552229.0000000006AF0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.ecma-international.org/ecma-262/#sec-promise.all
Source: cMqyGFCQHk.exe, 00000000.00000003.2406907152.0000000006EF0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.ecma-international.org/ecma-262/5.1/#sec-15.1.3.4
Source: cMqyGFCQHk.exe, 00000000.00000003.2293258093.0000000005CF0000.00000004.00001000.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2418539279.0000000005197000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.khronos.org/registry/
Source: cMqyGFCQHk.exe, 00000000.00000003.2304404903.00000000057F0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.npmjs.com/package/wrap-ansi
Source: cMqyGFCQHk.exe, 00000000.00000003.2293258093.0000000005CF0000.00000004.00001000.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2418539279.0000000005197000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.opensource.org/licenses/bsd-license.php)
Source: cMqyGFCQHk.exe, 00000000.00000003.2304404903.00000000057F0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.patreon.com/feross
Source: cMqyGFCQHk.exe, 00000000.00000003.2406552229.0000000006AF0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.rfc-editor.org/rfc/rfc8288.html#section-3
Source: cMqyGFCQHk.exe, 00000000.00000003.2406552229.0000000006AF0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.unicode.org/Public/UNIDATA/EastAsianWidth.txt
Source: cMqyGFCQHk.exe, 00000000.00000003.2406552229.0000000006AF0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://xhr.spec.whatwg.org/#interface-formdata
Source: cMqyGFCQHk.exe, 00000000.00000003.2406907152.0000000006EF0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://xhr.spec.whatwg.org/.
Source: cMqyGFCQHk.exe, 00000000.00000003.2304404903.00000000057F0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://yargs.js.org/
Source: C:\Users\user\Desktop\cMqyGFCQHk.exeCode function: 0_2_00405461 GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetClientRect,GetSystemMetrics,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,ShowWindow,ShowWindow,GetDlgItem,SendMessageW,SendMessageW,SendMessageW,GetDlgItem,CreateThread,CloseHandle,ShowWindow,ShowWindow,ShowWindow,ShowWindow,SendMessageW,CreatePopupMenu,AppendMenuW,GetWindowRect,TrackPopupMenu,SendMessageW,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageW,GlobalUnlock,SetClipboardData,CloseClipboard,0_2_00405461
Source: cMqyGFCQHk.exe, 00000000.00000003.2407447233.00000000073F3000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: GetRawInputDatamemstr_36524828-3

System Summary

barindex
Drops large PE files
Source: C:\Users\user\Desktop\cMqyGFCQHk.exeFile dump: Teams.exe.0.dr 188819968Jump to dropped file
Source: C:\Users\user\Desktop\cMqyGFCQHk.exeFile dump: Teams.exe0.0.dr 188819968Jump to dropped file
Source: C:\Users\user\Desktop\cMqyGFCQHk.exeCode function: 0_2_0040338F EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,ExitProcess,CoUninitialize,ExitProcess,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,0_2_0040338F
Source: C:\Users\user\Desktop\cMqyGFCQHk.exeCode function: 0_2_00406B150_2_00406B15
Source: C:\Users\user\Desktop\cMqyGFCQHk.exeCode function: 0_2_004072EC0_2_004072EC
Source: C:\Users\user\Desktop\cMqyGFCQHk.exeCode function: 0_2_00404C9E0_2_00404C9E
Source: C:\Users\user\Desktop\cMqyGFCQHk.exeProcess token adjusted: SecurityJump to behavior
Source: cMqyGFCQHk.exeStatic PE information: invalid certificate
Source: Teams.exe0.0.drStatic PE information: Number of sections : 15 > 10
Source: Teams.exe.0.drStatic PE information: Number of sections : 15 > 10
Source: cMqyGFCQHk.exe, 00000000.00000003.2477515999.000000000519A000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamevk_swiftshader.dll, vs cMqyGFCQHk.exe
Source: cMqyGFCQHk.exe, 00000000.00000003.2406552229.0000000006AF0000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFilenamevk_swiftshader.dll, vs cMqyGFCQHk.exe
Source: cMqyGFCQHk.exe, 00000000.00000003.2423239558.0000000005192000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename, vs cMqyGFCQHk.exe
Source: cMqyGFCQHk.exe, 00000000.00000003.2415397263.0000000004C34000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamelibEGL.dllb! vs cMqyGFCQHk.exe
Source: cMqyGFCQHk.exe, 00000000.00000003.2309788789.0000000005D56000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFilenamed3dcompiler_47.dllj% vs cMqyGFCQHk.exe
Source: cMqyGFCQHk.exe, 00000000.00000003.2416602923.0000000005190000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamelibGLESv2.dllb! vs cMqyGFCQHk.exe
Source: cMqyGFCQHk.exe, 00000000.00000003.2317642252.0000000006AF0000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFilenamelibGLESv2.dllb! vs cMqyGFCQHk.exe
Source: cMqyGFCQHk.exe, 00000000.00000003.2409838844.000000000519E000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamed3dcompiler_47.dllj% vs cMqyGFCQHk.exe
Source: cMqyGFCQHk.exeStatic PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
Source: classification engineClassification label: mal60.spre.winEXE@32/110@0/0
Source: C:\Users\user\Desktop\cMqyGFCQHk.exeCode function: 0_2_0040338F EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,ExitProcess,CoUninitialize,ExitProcess,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,0_2_0040338F
Source: C:\Users\user\Desktop\cMqyGFCQHk.exeCode function: 0_2_00404722 GetDlgItem,SetWindowTextW,SHBrowseForFolderW,CoTaskMemFree,lstrcmpiW,lstrcatW,SetDlgItemTextW,GetDiskFreeSpaceW,MulDiv,SetDlgItemTextW,0_2_00404722
Source: C:\Users\user\Desktop\cMqyGFCQHk.exeCode function: 0_2_00402104 CoCreateInstance,0_2_00402104
Source: C:\Users\user\Desktop\cMqyGFCQHk.exeFile created: C:\Users\user\AppData\Local\ProgramsJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeMutant created: NULL
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeMutant created: \Sessions\1\BaseNamedObjects\mfx_d3d_mutex
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7084:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6504:120:WilError_03
Source: C:\Users\user\Desktop\cMqyGFCQHk.exeMutant created: \Sessions\1\BaseNamedObjects\8013f783-e1a2-5f53-80da-b1ad483bd59f
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5748:120:WilError_03
Source: C:\Users\user\Desktop\cMqyGFCQHk.exeFile created: C:\Users\user\AppData\Local\Temp\nswF9C0.tmpJump to behavior
Source: cMqyGFCQHk.exeStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: C:\Windows\SysWOW64\tasklist.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process WHERE Caption = &apos;TEAMS.EXE&apos;
Source: C:\Users\user\Desktop\cMqyGFCQHk.exeFile read: C:\Users\desktop.iniJump to behavior
Source: C:\Users\user\Desktop\cMqyGFCQHk.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeFile read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeFile read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeFile read: C:\Windows\System32\drivers\etc\hosts
Source: cMqyGFCQHk.exe, 00000000.00000003.2406907152.0000000007248000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: SELECT name FROM sqlite_master WHERE type='table';
Source: C:\Users\user\Desktop\cMqyGFCQHk.exeFile read: C:\Users\user\Desktop\cMqyGFCQHk.exeJump to behavior
Source: unknownProcess created: C:\Users\user\Desktop\cMqyGFCQHk.exe "C:\Users\user\Desktop\cMqyGFCQHk.exe"
Source: C:\Users\user\Desktop\cMqyGFCQHk.exeProcess created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c tasklist /FI "USERNAME eq %USERNAME%" /FI "IMAGENAME eq Teams.exe" /FO csv | "C:\Windows\system32\find.exe" "Teams.exe"
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\tasklist.exe tasklist /FI "USERNAME eq user" /FI "IMAGENAME eq Teams.exe" /FO csv
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\find.exe "C:\Windows\system32\find.exe" "Teams.exe"
Source: unknownProcess created: C:\Users\user\AppData\Local\Programs\Teams\Teams.exe "C:\Users\user\AppData\Local\Programs\Teams\Teams.exe"
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "powershell "$s=(New-Object -COM WScript.Shell).CreateShortcut('C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MyElectronApp.lnk');$s.TargetPath='C:\Users\user\AppData\Local\Programs\Teams\Teams.exe';$s.Save()""
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeProcess created: C:\Users\user\AppData\Local\Programs\Teams\Teams.exe "C:\Users\user\AppData\Local\Programs\Teams\Teams.exe" --type=gpu-process --user-data-dir="C:\Users\user\AppData\Roaming\Teams" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=1804,i,4916229494749615140,4144486409714305981,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=1796 /prefetch:2
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell "$s=(New-Object -COM WScript.Shell).CreateShortcut('C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MyElectronApp.lnk');$s.TargetPath='C:\Users\user\AppData\Local\Programs\Teams\Teams.exe';$s.Save()"
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeProcess created: C:\Users\user\AppData\Local\Programs\Teams\Teams.exe "C:\Users\user\AppData\Local\Programs\Teams\Teams.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --user-data-dir="C:\Users\user\AppData\Roaming\Teams" --field-trial-handle=2464,i,4916229494749615140,4144486409714305981,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2416 /prefetch:3
Source: unknownProcess created: C:\Users\user\AppData\Local\Programs\Teams\Teams.exe "C:\Users\user\AppData\Local\Programs\Teams\Teams.exe"
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeProcess created: C:\Users\user\AppData\Local\Programs\Teams\Teams.exe "C:\Users\user\AppData\Local\Programs\Teams\Teams.exe" --type=gpu-process --user-data-dir="C:\Users\user\AppData\Roaming\Teams" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=1704,i,126123718397027599,14626746628952611418,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=1696 /prefetch:2
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "powershell "$s=(New-Object -COM WScript.Shell).CreateShortcut('C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MyElectronApp.lnk');$s.TargetPath='C:\Users\user\AppData\Local\Programs\Teams\Teams.exe';$s.Save()""
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell "$s=(New-Object -COM WScript.Shell).CreateShortcut('C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MyElectronApp.lnk');$s.TargetPath='C:\Users\user\AppData\Local\Programs\Teams\Teams.exe';$s.Save()"
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeProcess created: C:\Users\user\AppData\Local\Programs\Teams\Teams.exe "C:\Users\user\AppData\Local\Programs\Teams\Teams.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --user-data-dir="C:\Users\user\AppData\Roaming\Teams" --field-trial-handle=2428,i,126123718397027599,14626746628952611418,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2424 /prefetch:3
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeProcess created: C:\Users\user\AppData\Local\Programs\Teams\Teams.exe "C:\Users\user\AppData\Local\Programs\Teams\Teams.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --user-data-dir="C:\Users\user\AppData\Roaming\Teams" --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=2548,i,4916229494749615140,4144486409714305981,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2544 /prefetch:8
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeProcess created: C:\Users\user\AppData\Local\Programs\Teams\Teams.exe "C:\Users\user\AppData\Local\Programs\Teams\Teams.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --user-data-dir="C:\Users\user\AppData\Roaming\Teams" --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=1200,i,126123718397027599,14626746628952611418,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2484 /prefetch:8
Source: C:\Users\user\Desktop\cMqyGFCQHk.exeProcess created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c tasklist /FI "USERNAME eq %USERNAME%" /FI "IMAGENAME eq Teams.exe" /FO csv | "C:\Windows\system32\find.exe" "Teams.exe"Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\tasklist.exe tasklist /FI "USERNAME eq user" /FI "IMAGENAME eq Teams.exe" /FO csv Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\find.exe "C:\Windows\system32\find.exe" "Teams.exe"Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "powershell "$s=(New-Object -COM WScript.Shell).CreateShortcut('C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MyElectronApp.lnk');$s.TargetPath='C:\Users\user\AppData\Local\Programs\Teams\Teams.exe';$s.Save()""Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeProcess created: C:\Users\user\AppData\Local\Programs\Teams\Teams.exe "C:\Users\user\AppData\Local\Programs\Teams\Teams.exe" --type=gpu-process --user-data-dir="C:\Users\user\AppData\Roaming\Teams" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=1804,i,4916229494749615140,4144486409714305981,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=1796 /prefetch:2Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeProcess created: C:\Users\user\AppData\Local\Programs\Teams\Teams.exe "C:\Users\user\AppData\Local\Programs\Teams\Teams.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --user-data-dir="C:\Users\user\AppData\Roaming\Teams" --field-trial-handle=2464,i,4916229494749615140,4144486409714305981,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2416 /prefetch:3Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeProcess created: C:\Users\user\AppData\Local\Programs\Teams\Teams.exe "C:\Users\user\AppData\Local\Programs\Teams\Teams.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --user-data-dir="C:\Users\user\AppData\Roaming\Teams" --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=2548,i,4916229494749615140,4144486409714305981,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2544 /prefetch:8Jump to behavior
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell "$s=(New-Object -COM WScript.Shell).CreateShortcut('C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MyElectronApp.lnk');$s.TargetPath='C:\Users\user\AppData\Local\Programs\Teams\Teams.exe';$s.Save()"Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeProcess created: C:\Users\user\AppData\Local\Programs\Teams\Teams.exe "C:\Users\user\AppData\Local\Programs\Teams\Teams.exe" --type=gpu-process --user-data-dir="C:\Users\user\AppData\Roaming\Teams" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=1704,i,126123718397027599,14626746628952611418,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=1696 /prefetch:2
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "powershell "$s=(New-Object -COM WScript.Shell).CreateShortcut('C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MyElectronApp.lnk');$s.TargetPath='C:\Users\user\AppData\Local\Programs\Teams\Teams.exe';$s.Save()""
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeProcess created: C:\Users\user\AppData\Local\Programs\Teams\Teams.exe "C:\Users\user\AppData\Local\Programs\Teams\Teams.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --user-data-dir="C:\Users\user\AppData\Roaming\Teams" --field-trial-handle=2428,i,126123718397027599,14626746628952611418,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2424 /prefetch:3
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeProcess created: C:\Users\user\AppData\Local\Programs\Teams\Teams.exe "C:\Users\user\AppData\Local\Programs\Teams\Teams.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --user-data-dir="C:\Users\user\AppData\Roaming\Teams" --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=1200,i,126123718397027599,14626746628952611418,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2484 /prefetch:8
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell "$s=(New-Object -COM WScript.Shell).CreateShortcut('C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MyElectronApp.lnk');$s.TargetPath='C:\Users\user\AppData\Local\Programs\Teams\Teams.exe';$s.Save()"
Source: C:\Users\user\Desktop\cMqyGFCQHk.exeSection loaded: uxtheme.dllJump to behavior
Source: C:\Users\user\Desktop\cMqyGFCQHk.exeSection loaded: userenv.dllJump to behavior
Source: C:\Users\user\Desktop\cMqyGFCQHk.exeSection loaded: apphelp.dllJump to behavior
Source: C:\Users\user\Desktop\cMqyGFCQHk.exeSection loaded: propsys.dllJump to behavior
Source: C:\Users\user\Desktop\cMqyGFCQHk.exeSection loaded: dwmapi.dllJump to behavior
Source: C:\Users\user\Desktop\cMqyGFCQHk.exeSection loaded: cryptbase.dllJump to behavior
Source: C:\Users\user\Desktop\cMqyGFCQHk.exeSection loaded: oleacc.dllJump to behavior
Source: C:\Users\user\Desktop\cMqyGFCQHk.exeSection loaded: ntmarta.dllJump to behavior
Source: C:\Users\user\Desktop\cMqyGFCQHk.exeSection loaded: version.dllJump to behavior
Source: C:\Users\user\Desktop\cMqyGFCQHk.exeSection loaded: shfolder.dllJump to behavior
Source: C:\Users\user\Desktop\cMqyGFCQHk.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Users\user\Desktop\cMqyGFCQHk.exeSection loaded: windows.storage.dllJump to behavior
Source: C:\Users\user\Desktop\cMqyGFCQHk.exeSection loaded: wldp.dllJump to behavior
Source: C:\Users\user\Desktop\cMqyGFCQHk.exeSection loaded: profapi.dllJump to behavior
Source: C:\Users\user\Desktop\cMqyGFCQHk.exeSection loaded: riched20.dllJump to behavior
Source: C:\Users\user\Desktop\cMqyGFCQHk.exeSection loaded: usp10.dllJump to behavior
Source: C:\Users\user\Desktop\cMqyGFCQHk.exeSection loaded: msls31.dllJump to behavior
Source: C:\Users\user\Desktop\cMqyGFCQHk.exeSection loaded: textshaping.dllJump to behavior
Source: C:\Users\user\Desktop\cMqyGFCQHk.exeSection loaded: textinputframework.dllJump to behavior
Source: C:\Users\user\Desktop\cMqyGFCQHk.exeSection loaded: coreuicomponents.dllJump to behavior
Source: C:\Users\user\Desktop\cMqyGFCQHk.exeSection loaded: coremessaging.dllJump to behavior
Source: C:\Users\user\Desktop\cMqyGFCQHk.exeSection loaded: wintypes.dllJump to behavior
Source: C:\Users\user\Desktop\cMqyGFCQHk.exeSection loaded: wintypes.dllJump to behavior
Source: C:\Users\user\Desktop\cMqyGFCQHk.exeSection loaded: wintypes.dllJump to behavior
Source: C:\Users\user\Desktop\cMqyGFCQHk.exeSection loaded: windows.staterepositoryps.dllJump to behavior
Source: C:\Users\user\Desktop\cMqyGFCQHk.exeSection loaded: windows.fileexplorer.common.dllJump to behavior
Source: C:\Users\user\Desktop\cMqyGFCQHk.exeSection loaded: iertutil.dllJump to behavior
Source: C:\Users\user\Desktop\cMqyGFCQHk.exeSection loaded: ntshrui.dllJump to behavior
Source: C:\Users\user\Desktop\cMqyGFCQHk.exeSection loaded: sspicli.dllJump to behavior
Source: C:\Users\user\Desktop\cMqyGFCQHk.exeSection loaded: sxs.dllJump to behavior
Source: C:\Users\user\Desktop\cMqyGFCQHk.exeSection loaded: onecorecommonproxystub.dllJump to behavior
Source: C:\Users\user\Desktop\cMqyGFCQHk.exeSection loaded: onecoreuapcommonproxystub.dllJump to behavior
Source: C:\Users\user\Desktop\cMqyGFCQHk.exeSection loaded: msasn1.dllJump to behavior
Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: version.dllJump to behavior
Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: mpr.dllJump to behavior
Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: framedynos.dllJump to behavior
Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: dbghelp.dllJump to behavior
Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: sspicli.dllJump to behavior
Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: srvcli.dllJump to behavior
Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: netutils.dllJump to behavior
Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: sspicli.dllJump to behavior
Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: wbemcomn.dllJump to behavior
Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: winsta.dllJump to behavior
Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: amsi.dllJump to behavior
Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: userenv.dllJump to behavior
Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: profapi.dllJump to behavior
Source: C:\Windows\SysWOW64\find.exeSection loaded: ulib.dllJump to behavior
Source: C:\Windows\SysWOW64\find.exeSection loaded: fsutilext.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: ffmpeg.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: dbghelp.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: winmm.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: iphlpapi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: userenv.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: version.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: dwrite.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: secur32.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: winhttp.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: dhcpcsvc.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: dbgcore.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: dpapi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: sspicli.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: msasn1.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: powrprof.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: umpdc.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: uxtheme.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: mswsock.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: ntmarta.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: kbdus.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: windows.storage.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: wldp.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: cryptbase.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: nlaapi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: dhcpcsvc6.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: dnsapi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: textinputframework.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: coreuicomponents.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: coremessaging.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: coremessaging.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: wintypes.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: wintypes.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: wintypes.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: windows.ui.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: windowmanagementapi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: inputhost.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: twinapi.appcore.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: twinapi.appcore.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: propsys.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: profapi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: wtsapi32.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: winsta.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: mscms.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: coloradapterclient.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: mmdevapi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: devobj.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: cryptsp.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: rsaenh.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: gpapi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: duser.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: xmllite.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: netprofm.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: atlthunk.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: npmproxy.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: textshaping.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: ffmpeg.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: dbghelp.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: winmm.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: iphlpapi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: userenv.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: version.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: dwrite.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: secur32.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: winhttp.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: dhcpcsvc.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: dbgcore.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: dpapi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: sspicli.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: msasn1.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: powrprof.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: umpdc.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: uxtheme.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: mswsock.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: dxcore.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: dxgi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: resourcepolicyclient.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: mf.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: mfplat.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: rtworkq.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: dwmapi.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: atl.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mscoree.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: version.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: vcruntime140_clr0400.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptsp.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rsaenh.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptbase.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: amsi.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: userenv.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: profapi.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: windows.storage.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wldp.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msasn1.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: gpapi.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msisip.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wshext.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: appxsip.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: opcservices.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: secur32.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: sspicli.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: uxtheme.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: sxs.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mpr.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: scrrun.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: propsys.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: linkinfo.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ntshrui.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: srvcli.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cscapi.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: netutils.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: ffmpeg.dll
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: dbghelp.dll
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: version.dll
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: dwrite.dll
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: secur32.dll
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: dhcpcsvc.dll
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: dbgcore.dll
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: dpapi.dll
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: powrprof.dll
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: umpdc.dll
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: ntmarta.dll
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: kbdus.dll
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: dhcpcsvc6.dll
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: netprofm.dll
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: npmproxy.dll
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: ffmpeg.dll
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: dbghelp.dll
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: version.dll
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: dwrite.dll
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: secur32.dll
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: dhcpcsvc.dll
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: dbgcore.dll
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: dpapi.dll
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: powrprof.dll
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: umpdc.dll
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: ntmarta.dll
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: kbdus.dll
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: dhcpcsvc6.dll
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: textinputframework.dll
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: coreuicomponents.dll
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: coremessaging.dll
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: coremessaging.dll
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: windows.ui.dll
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: windowmanagementapi.dll
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: inputhost.dll
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: twinapi.appcore.dll
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: twinapi.appcore.dll
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: wtsapi32.dll
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: mmdevapi.dll
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: devobj.dll
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: mscms.dll
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: coloradapterclient.dll
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: winsta.dll
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: gpapi.dll
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: netprofm.dll
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: npmproxy.dll
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: ffmpeg.dll
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: dbghelp.dll
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: version.dll
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: dwrite.dll
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: secur32.dll
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: dhcpcsvc.dll
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: dbgcore.dll
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: dpapi.dll
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: powrprof.dll
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: umpdc.dll
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: dxcore.dll
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: dxgi.dll
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: resourcepolicyclient.dll
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: mf.dll
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: mfplat.dll
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: rtworkq.dll
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: dwmapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: uxtheme.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: sxs.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mpr.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: scrrun.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: propsys.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: linkinfo.dll
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: ffmpeg.dll
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: dbghelp.dll
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: version.dll
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: dwrite.dll
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: secur32.dll
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: dhcpcsvc.dll
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: dbgcore.dll
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: dpapi.dll
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: powrprof.dll
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: umpdc.dll
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: ntmarta.dll
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: kbdus.dll
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: dhcpcsvc6.dll
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: netprofm.dll
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: npmproxy.dll
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: ffmpeg.dll
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: dbghelp.dll
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: version.dll
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: dwrite.dll
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: secur32.dll
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: dhcpcsvc.dll
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: dbgcore.dll
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: dpapi.dll
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: powrprof.dll
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: umpdc.dll
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: ntmarta.dll
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: kbdus.dll
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: dxgi.dll
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: resourcepolicyclient.dll
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: d3d11.dll
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: d3d11.dll
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: dxcore.dll
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: mf.dll
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: mfplat.dll
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: rtworkq.dll
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: d3d12.dll
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: d3d12.dll
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: d3d12core.dll
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: d3d10warp.dll
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: dxilconv.dll
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: d3dscache.dll
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: twinapi.appcore.dll
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: directml.dll
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: cabinet.dll
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: ffmpeg.dll
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: dbghelp.dll
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: version.dll
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: dwrite.dll
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: secur32.dll
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: dhcpcsvc.dll
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: dbgcore.dll
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: dpapi.dll
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: powrprof.dll
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: umpdc.dll
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: ntmarta.dll
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: kbdus.dll
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: dxgi.dll
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: resourcepolicyclient.dll
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: d3d11.dll
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: d3d11.dll
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: dxcore.dll
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: mf.dll
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: mfplat.dll
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: rtworkq.dll
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: d3d12.dll
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: d3d12.dll
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: d3d12core.dll
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: d3d10warp.dll
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: dxilconv.dll
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: d3dscache.dll
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: twinapi.appcore.dll
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: directml.dll
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeSection loaded: cabinet.dll
Source: C:\Users\user\Desktop\cMqyGFCQHk.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\tasklist.exe tasklist /FI "USERNAME eq user" /FI "IMAGENAME eq Teams.exe" /FO csv
Source: MyElectronApp.lnk.14.drLNK file: ..\..\..\..\..\..\Local\Programs\Teams\Teams.exe
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dllJump to behavior
Source: C:\Users\user\Desktop\cMqyGFCQHk.exeRegistry value created: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\8013f783-e1a2-5f53-80da-b1ad483bd59fJump to behavior
Source: cMqyGFCQHk.exeStatic file information: File size 86797392 > 1048576
Source: cMqyGFCQHk.exeStatic PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Source: Binary string: ffmpeg.dll.pdb source: cMqyGFCQHk.exe, 00000000.00000003.2411113268.000000000519B000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D3DCompiler_47.pdb source: cMqyGFCQHk.exe, 00000000.00000003.2409838844.000000000519E000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: libEGL.dll.pdb source: cMqyGFCQHk.exe, 00000000.00000003.2415397263.0000000004C34000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\dev\test\x64\Release\test.pdb source: cMqyGFCQHk.exe, 00000000.00000003.2483412748.0000000004DF1000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: vulkan-1.dll.pdb source: cMqyGFCQHk.exe, 00000000.00000003.2406041139.00000000066F0000.00000004.00001000.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2402713940.0000000005CF0000.00000004.00001000.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2402317830.0000000005330000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: C:\dev\test\Release\test.pdb source: cMqyGFCQHk.exe, 00000000.00000003.2483647992.0000000004DF1000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D3DCompiler_47.pdbGCTL source: cMqyGFCQHk.exe, 00000000.00000003.2409838844.000000000519E000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: electron.exe.pdb source: cMqyGFCQHk.exe, 00000000.00000003.2407447233.00000000073F3000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: <C:\dev\test\x64\Release\test.pdb source: cMqyGFCQHk.exe, 00000000.00000003.2483412748.0000000004DF1000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: libGLESv2.dll.pdb source: cMqyGFCQHk.exe, 00000000.00000003.2416602923.0000000005190000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2317642252.0000000006AF0000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: vk_swiftshader.dll.pdb source: cMqyGFCQHk.exe, 00000000.00000003.2477515999.000000000519A000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2406552229.0000000006AF0000.00000004.00001000.00020000.00000000.sdmp
Source: ffmpeg.dll.0.drStatic PE information: section name: .gxfg
Source: ffmpeg.dll.0.drStatic PE information: section name: .retplne
Source: ffmpeg.dll.0.drStatic PE information: section name: _RDATA
Source: libEGL.dll.0.drStatic PE information: section name: .gxfg
Source: libEGL.dll.0.drStatic PE information: section name: .retplne
Source: libEGL.dll.0.drStatic PE information: section name: _RDATA
Source: libGLESv2.dll.0.drStatic PE information: section name: .gxfg
Source: libGLESv2.dll.0.drStatic PE information: section name: .retplne
Source: libGLESv2.dll.0.drStatic PE information: section name: _RDATA
Source: Teams.exe.0.drStatic PE information: section name: .gxfg
Source: Teams.exe.0.drStatic PE information: section name: .retplne
Source: Teams.exe.0.drStatic PE information: section name: .rodata
Source: Teams.exe.0.drStatic PE information: section name: CPADinfo
Source: Teams.exe.0.drStatic PE information: section name: LZMADEC
Source: Teams.exe.0.drStatic PE information: section name: _RDATA
Source: Teams.exe.0.drStatic PE information: section name: malloc_h
Source: Teams.exe.0.drStatic PE information: section name: prot
Source: ffmpeg.dll0.0.drStatic PE information: section name: .gxfg
Source: ffmpeg.dll0.0.drStatic PE information: section name: .retplne
Source: ffmpeg.dll0.0.drStatic PE information: section name: _RDATA
Source: libEGL.dll0.0.drStatic PE information: section name: .gxfg
Source: libEGL.dll0.0.drStatic PE information: section name: .retplne
Source: libEGL.dll0.0.drStatic PE information: section name: _RDATA
Source: libGLESv2.dll0.0.drStatic PE information: section name: .gxfg
Source: libGLESv2.dll0.0.drStatic PE information: section name: .retplne
Source: libGLESv2.dll0.0.drStatic PE information: section name: _RDATA
Source: fastlist-0.3.0-x64.exe.0.drStatic PE information: section name: _RDATA
Source: Teams.exe0.0.drStatic PE information: section name: .gxfg
Source: Teams.exe0.0.drStatic PE information: section name: .retplne
Source: Teams.exe0.0.drStatic PE information: section name: .rodata
Source: Teams.exe0.0.drStatic PE information: section name: CPADinfo
Source: Teams.exe0.0.drStatic PE information: section name: LZMADEC
Source: Teams.exe0.0.drStatic PE information: section name: _RDATA
Source: Teams.exe0.0.drStatic PE information: section name: malloc_h
Source: Teams.exe0.0.drStatic PE information: section name: prot
Source: vk_swiftshader.dll.0.drStatic PE information: section name: .gxfg
Source: vk_swiftshader.dll.0.drStatic PE information: section name: .retplne
Source: vk_swiftshader.dll.0.drStatic PE information: section name: _RDATA
Source: vulkan-1.dll.0.drStatic PE information: section name: .gxfg
Source: vulkan-1.dll.0.drStatic PE information: section name: .retplne
Source: vulkan-1.dll.0.drStatic PE information: section name: _RDATA
Source: C:\Users\user\Desktop\cMqyGFCQHk.exeFile created: C:\Users\user\AppData\Local\Programs\Teams\d3dcompiler_47.dllJump to dropped file
Source: C:\Users\user\Desktop\cMqyGFCQHk.exeFile created: C:\Users\user\AppData\Local\Temp\nshFAEA.tmp\7z-out\libEGL.dllJump to dropped file
Source: C:\Users\user\Desktop\cMqyGFCQHk.exeFile created: C:\Users\user\AppData\Local\Temp\nshFAEA.tmp\7z-out\ffmpeg.dllJump to dropped file
Source: C:\Users\user\Desktop\cMqyGFCQHk.exeFile created: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeJump to dropped file
Source: C:\Users\user\Desktop\cMqyGFCQHk.exeFile created: C:\Users\user\AppData\Local\Temp\nshFAEA.tmp\StdUtils.dllJump to dropped file
Source: C:\Users\user\Desktop\cMqyGFCQHk.exeFile created: C:\Users\user\AppData\Local\Temp\nshFAEA.tmp\7z-out\resources\elevate.exeJump to dropped file
Source: C:\Users\user\Desktop\cMqyGFCQHk.exeFile created: C:\Users\user\AppData\Local\Temp\nshFAEA.tmp\System.dllJump to dropped file
Source: C:\Users\user\Desktop\cMqyGFCQHk.exeFile created: C:\Users\user\AppData\Local\Temp\nshFAEA.tmp\nsExec.dllJump to dropped file
Source: C:\Users\user\Desktop\cMqyGFCQHk.exeFile created: C:\Users\user\AppData\Local\Temp\nshFAEA.tmp\7z-out\Teams.exeJump to dropped file
Source: C:\Users\user\Desktop\cMqyGFCQHk.exeFile created: C:\Users\user\AppData\Local\Programs\Teams\libGLESv2.dllJump to dropped file
Source: C:\Users\user\Desktop\cMqyGFCQHk.exeFile created: C:\Users\user\AppData\Local\Temp\nshFAEA.tmp\nsis7z.dllJump to dropped file
Source: C:\Users\user\Desktop\cMqyGFCQHk.exeFile created: C:\Users\user\AppData\Local\Temp\nshFAEA.tmp\7z-out\d3dcompiler_47.dllJump to dropped file
Source: C:\Users\user\Desktop\cMqyGFCQHk.exeFile created: C:\Users\user\AppData\Local\Temp\nshFAEA.tmp\7z-out\vulkan-1.dllJump to dropped file
Source: C:\Users\user\Desktop\cMqyGFCQHk.exeFile created: C:\Users\user\AppData\Local\Temp\nshFAEA.tmp\7z-out\libGLESv2.dllJump to dropped file
Source: C:\Users\user\Desktop\cMqyGFCQHk.exeFile created: C:\Users\user\AppData\Local\Temp\nshFAEA.tmp\7z-out\resources\app.asar.unpacked\node_modules\ps-list\vendor\fastlist-0.3.0-x64.exeJump to dropped file
Source: C:\Users\user\Desktop\cMqyGFCQHk.exeFile created: C:\Users\user\AppData\Local\Temp\nshFAEA.tmp\7z-out\vk_swiftshader.dllJump to dropped file
Source: C:\Users\user\Desktop\cMqyGFCQHk.exeFile created: C:\Users\user\AppData\Local\Temp\nshFAEA.tmp\SpiderBanner.dllJump to dropped file
Source: C:\Users\user\Desktop\cMqyGFCQHk.exeFile created: C:\Users\user\AppData\Local\Programs\Teams\libEGL.dllJump to dropped file
Source: C:\Users\user\Desktop\cMqyGFCQHk.exeFile created: C:\Users\user\AppData\Local\Temp\nshFAEA.tmp\7z-out\resources\app.asar.unpacked\node_modules\ps-list\vendor\fastlist-0.3.0-x86.exeJump to dropped file
Source: C:\Users\user\Desktop\cMqyGFCQHk.exeFile created: C:\Users\user\AppData\Local\Programs\Teams\ffmpeg.dllJump to dropped file
Source: C:\Users\user\Desktop\cMqyGFCQHk.exeFile created: C:\Users\user\AppData\Local\Temp\nshFAEA.tmp\7z-out\LICENSE.electron.txtJump to behavior
Source: C:\Users\user\Desktop\cMqyGFCQHk.exeFile created: C:\Users\user\AppData\Local\Programs\Teams\LICENSE.electron.txtJump to behavior

Boot Survival

barindex
Powershell creates an autostart link
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeAnti Malware Scan Interface: .lnk');$s.TargetPath='C:\Users\user\AppData\Local\Programs\Teams\Teams.exe';$s.Save()@{# Script module or binary module file associated with this manifest.ModuleToProcess = 'Pester.psm1'# Version number of this module.ModuleVersion = '3.4.0'# ID used to uniquely identify this moduleGUID = 'a699dea5-2c73-4616-a270-1f7abb777e71'# Author of this moduleAuthor = 'Pester Team'# Company or vendor of this moduleCompanyName = 'Pester'# Copyright statement for this moduleCopyright = 'Copyright (c) 2016 by Pester Team, licensed under Apache 2.0 License.'# Description of the functionality provided by this moduleDescription = 'Pester provides a framework for running BDD style Tests to execute and validate PowerShell commands inside of PowerShell and offers a powerful set of Mocking Functions that allow tests to mimic and mock the functionality of any command inside of a piece of powershell code being tested. Pester tests can execute any command or script that is accesible to a pester test file. This can include functions, Cmdlets, Modules and scripts. Pester can be run in ad hoc style in a console or it can be integrated into the Build scripts of a Continuous Integration system.'# Minimum version of the Windows PowerShell user required by this modulePowerShellVersion = '2.0'# Functions to export from this moduleFunctionsToExport = @( 'Describe', 'Context', 'It', 'Should', 'Mock', 'Assert-MockCalled', 'Assert-VerifiableMocks', 'New-Fixture', 'Get-TestDriveItem', 'Invoke-Pester', 'Setup', 'In', 'InModuleScope', 'Invoke-Mock', 'BeforeEach', 'AfterEach', 'BeforeAll', 'AfterAll' 'Get-MockDynamicParameters', 'Set-DynamicParameterVariables', 'Set-TestInconclusive', 'SafeGetCommand', 'New-PesterOption')# # Cmdlets to export from this module# CmdletsToExport = '*'# Variables to export from this moduleVariablesToExport = @( 'Path', 'TagFilter', 'ExcludeTagFilter', 'TestNameFilter', 'TestResult', 'CurrentContext', 'CurrentDescribe', 'CurrentTest', 'SessionState', 'CommandCoverage', 'BeforeEach', 'AfterEach', 'Strict')# # Aliases to export from this module# AliasesToExport = '*'# List of all modules packaged with this module# ModuleList = @()# List of all files packaged with this module# FileList = @()PrivateData = @{ # PSData is module packaging and gallery metadata embedded in PrivateData # It's for rebuilding PowerShellGet (and PoshCode) NuGet-style packages # We had to do this because it's the only place we're allowed to extend the manifest # https://connect.microsoft.com/PowerShell/feedback/details/421837 PSData = @{ # The primary categorization of this module (from the TechNet Gallery tech tree). Category = "Scripting Techniques" # Keyword tags to help users find this module via navigations and search. Tags = @('powershell','unit testing','bdd','tdd','mocking') # The web address of an icon which can be
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeAnti Malware Scan Interface: .lnk');$s.TargetPath='C:\Users\user\AppData\Local\Programs\Teams\Teams.exe';$s.Save()@{# Script module or binary module file associated with this manifest.ModuleToProcess = 'Pester.psm1'# Version number of this module.ModuleVersion = '3.4.0'# ID used to uniquely identify this moduleGUID = 'a699dea5-2c73-4616-a270-1f7abb777e71'# Author of this moduleAuthor = 'Pester Team'# Company or vendor of this moduleCompanyName = 'Pester'# Copyright statement for this moduleCopyright = 'Copyright (c) 2016 by Pester Team, licensed under Apache 2.0 License.'# Description of the functionality provided by this moduleDescription = 'Pester provides a framework for running BDD style Tests to execute and validate PowerShell commands inside of PowerShell and offers a powerful set of Mocking Functions that allow tests to mimic and mock the functionality of any command inside of a piece of powershell code being tested. Pester tests can execute any command or script that is accesible to a pester test file. This can include functions, Cmdlets, Modules and scripts. Pester can be run in ad hoc style in a console or it can be integrated into the Build scripts of a Continuous Integration system.'# Minimum version of the Windows PowerShell user required by this modulePowerShellVersion = '2.0'# Functions to export from this moduleFunctionsToExport = @( 'Describe', 'Context', 'It', 'Should', 'Mock', 'Assert-MockCalled', 'Assert-VerifiableMocks', 'New-Fixture', 'Get-TestDriveItem', 'Invoke-Pester', 'Setup', 'In', 'InModuleScope', 'Invoke-Mock', 'BeforeEach', 'AfterEach', 'BeforeAll', 'AfterAll' 'Get-MockDynamicParameters', 'Set-DynamicParameterVariables', 'Set-TestInconclusive', 'SafeGetCommand', 'New-PesterOption')# # Cmdlets to export from this module# CmdletsToExport = '*'# Variables to export from this moduleVariablesToExport = @( 'Path', 'TagFilter', 'ExcludeTagFilter', 'TestNameFilter', 'TestResult', 'CurrentContext', 'CurrentDescribe', 'CurrentTest', 'SessionState', 'CommandCoverage', 'BeforeEach', 'AfterEach', 'Strict')# # Aliases to export from this module# AliasesToExport = '*'# List of all modules packaged with this module# ModuleList = @()# List of all files packaged with this module# FileList = @()PrivateData = @{ # PSData is module packaging and gallery metadata embedded in PrivateData # It's for rebuilding PowerShellGet (and PoshCode) NuGet-style packages # We had to do this because it's the only place we're allowed to extend the manifest # https://connect.microsoft.com/PowerShell/feedback/details/421837 PSData = @{ # The primary categorization of this module (from the TechNet Gallery tech tree). Category = "Scripting Techniques" # Keyword tags to help users find this module via navigations and search. Tags = @('powershell','unit testing','bdd','tdd','mocking') # The web address of an icon which can be
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MyElectronApp.lnkJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MyElectronApp.lnkJump to behavior
Source: C:\Users\user\Desktop\cMqyGFCQHk.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\cMqyGFCQHk.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\cMqyGFCQHk.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\cmd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\cmd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\cmd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\cmd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\conhost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\tasklist.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\tasklist.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\tasklist.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\tasklist.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\cmd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 3482Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 2537Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 3173
Source: C:\Users\user\Desktop\cMqyGFCQHk.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nshFAEA.tmp\7z-out\libEGL.dllJump to dropped file
Source: C:\Users\user\Desktop\cMqyGFCQHk.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Teams\d3dcompiler_47.dllJump to dropped file
Source: C:\Users\user\Desktop\cMqyGFCQHk.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nshFAEA.tmp\StdUtils.dllJump to dropped file
Source: C:\Users\user\Desktop\cMqyGFCQHk.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nshFAEA.tmp\7z-out\resources\elevate.exeJump to dropped file
Source: C:\Users\user\Desktop\cMqyGFCQHk.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nshFAEA.tmp\System.dllJump to dropped file
Source: C:\Users\user\Desktop\cMqyGFCQHk.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nshFAEA.tmp\nsExec.dllJump to dropped file
Source: C:\Users\user\Desktop\cMqyGFCQHk.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Teams\libGLESv2.dllJump to dropped file
Source: C:\Users\user\Desktop\cMqyGFCQHk.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nshFAEA.tmp\nsis7z.dllJump to dropped file
Source: C:\Users\user\Desktop\cMqyGFCQHk.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nshFAEA.tmp\7z-out\d3dcompiler_47.dllJump to dropped file
Source: C:\Users\user\Desktop\cMqyGFCQHk.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nshFAEA.tmp\7z-out\vulkan-1.dllJump to dropped file
Source: C:\Users\user\Desktop\cMqyGFCQHk.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nshFAEA.tmp\7z-out\resources\app.asar.unpacked\node_modules\ps-list\vendor\fastlist-0.3.0-x64.exeJump to dropped file
Source: C:\Users\user\Desktop\cMqyGFCQHk.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nshFAEA.tmp\7z-out\libGLESv2.dllJump to dropped file
Source: C:\Users\user\Desktop\cMqyGFCQHk.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nshFAEA.tmp\7z-out\vk_swiftshader.dllJump to dropped file
Source: C:\Users\user\Desktop\cMqyGFCQHk.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nshFAEA.tmp\SpiderBanner.dllJump to dropped file
Source: C:\Users\user\Desktop\cMqyGFCQHk.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nshFAEA.tmp\7z-out\resources\app.asar.unpacked\node_modules\ps-list\vendor\fastlist-0.3.0-x86.exeJump to dropped file
Source: C:\Users\user\Desktop\cMqyGFCQHk.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Teams\libEGL.dllJump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6880Thread sleep count: 3482 > 30Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4364Thread sleep count: 2537 > 30Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6052Thread sleep time: -922337203685477s >= -30000sJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1912Thread sleep time: -922337203685477s >= -30000sJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6452Thread sleep count: 3173 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5236Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7068Thread sleep count: 333 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6188Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeKey opened: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Keyboard Layouts\d0010809Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeKey opened: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Keyboard Layouts\d0010809
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeKey opened: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Keyboard Layouts\d0010809
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeKey opened: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Keyboard Layouts\d0010809
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeKey opened: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Keyboard Layouts\d0010809
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeKey opened: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Keyboard Layouts\d0010809
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: C:\Users\user\Desktop\cMqyGFCQHk.exeFile Volume queried: C:\ FullSizeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeFile Volume queried: C:\Users\user\AppData\Local\Programs\Teams FullSizeInformation
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeFile Volume queried: C:\Users\user\AppData\Local\Programs\Teams FullSizeInformation
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeFile Volume queried: C:\Users\user\AppData\Local\Temp FullSizeInformation
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeFile Volume queried: C:\Users\user\AppData\Local\Temp FullSizeInformation
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeFile Volume queried: C:\Users\user\AppData\Local\Programs\Teams FullSizeInformation
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeFile Volume queried: C:\Users\user\AppData\Local\Programs\Teams FullSizeInformation
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeFile Volume queried: C:\Users\user FullSizeInformation
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeFile Volume queried: C:\Users\user FullSizeInformation
Source: C:\Users\user\Desktop\cMqyGFCQHk.exeCode function: 0_2_004059CC GetTempPathW,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose,0_2_004059CC
Source: C:\Users\user\Desktop\cMqyGFCQHk.exeCode function: 0_2_004065FD FindFirstFileW,FindClose,0_2_004065FD
Source: C:\Users\user\Desktop\cMqyGFCQHk.exeCode function: 0_2_00402868 FindFirstFileW,0_2_00402868
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
Source: C:\Users\user\Desktop\cMqyGFCQHk.exeFile opened: C:\Users\user\AppData\Local\Temp\nshFAEA.tmp\7z-out\resources\app.asar.unpacked\node_modulesJump to behavior
Source: C:\Users\user\Desktop\cMqyGFCQHk.exeFile opened: C:\Users\user\AppData\Local\Temp\nshFAEA.tmp\7z-out\resources\app.asar.unpacked\node_modules\ps-listJump to behavior
Source: C:\Users\user\Desktop\cMqyGFCQHk.exeFile opened: C:\Users\user\AppData\Local\Temp\nshFAEA.tmp\7z-out\localesJump to behavior
Source: C:\Users\user\Desktop\cMqyGFCQHk.exeFile opened: C:\Users\user\AppData\Local\Temp\nshFAEA.tmp\7z-out\resources\app.asar.unpacked\node_modules\ps-list\vendorJump to behavior
Source: C:\Users\user\Desktop\cMqyGFCQHk.exeFile opened: C:\Users\user\AppData\Local\Temp\nshFAEA.tmp\7z-out\resourcesJump to behavior
Source: C:\Users\user\Desktop\cMqyGFCQHk.exeFile opened: C:\Users\user\AppData\Local\Temp\nshFAEA.tmp\7z-out\resources\app.asar.unpackedJump to behavior
Source: cMqyGFCQHk.exe, 00000000.00000003.2406907152.0000000006EF0000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: bCK1sK9IRQq9qEmUv4RDsNuESgMjGWdqb8FuvAY5N9GIIvejQjBAMA8GA1UdEwEB/wQFMAMB
Source: cMqyGFCQHk.exe, 00000000.00000003.2317642252.0000000006AF0000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: VMware
Source: cMqyGFCQHk.exe, 00000000.00000003.2317642252.0000000006AF0000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: (IsLinux() && isVMWare) || (IsAndroid() && isNvidia) || (IsAndroid() && GetAndroidSDKVersion() < 27 && IsAdreno5xxOrOlder(functions)) || (!isMesa && IsMaliT8xxOrOlder(functions)) || (!isMesa && IsMaliG31OrOlder(functions))
Source: cMqyGFCQHk.exe, 00000000.00000003.2487835744.0000000004E9D000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: q00#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&
Source: cMqyGFCQHk.exe, 00000000.00000003.2411113268.000000000519B000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: vmncVMware Screen Codec / VMware Videovp5On2 VP5vp6On2 VP6vp6fOn2 VP6 (Flash version)targaTruevision Targa imageimage/x-targaimage/x-tgaR
Source: cMqyGFCQHk.exe, 00000000.00000003.2525644791.0000000000728000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a
Source: cMqyGFCQHk.exe, 00000000.00000003.2406907152.0000000006EF0000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: lgnW2/4/PEZB31jiVg88O8EckzXZOFKs7sjsLjBOlDW0JB9LeGna8gI4zJVSk/BwJVmcIGfE
Source: cMqyGFCQHk.exe, 00000000.00000003.2411113268.000000000519B000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: VMware Screen Codec / VMware Video
Source: cMqyGFCQHk.exe, 00000000.00000003.2317642252.0000000006AF0000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: ZAMDARMAppleBroadcomGoogleIntelMesaMicrosoftNVIDIAImagination TechnologiesQualcommSamsung Electronics Co., Ltd.VivanteVMwareVirtIOTestp
Source: C:\Users\user\Desktop\cMqyGFCQHk.exeAPI call chain: ExitProcess graph end nodegraph_0-3391
Source: C:\Users\user\Desktop\cMqyGFCQHk.exeProcess information queried: ProcessInformationJump to behavior
Source: C:\Windows\SysWOW64\tasklist.exeProcess token adjusted: DebugJump to behavior
Source: C:\Users\user\Desktop\cMqyGFCQHk.exeProcess created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c tasklist /FI "USERNAME eq %USERNAME%" /FI "IMAGENAME eq Teams.exe" /FO csv | "C:\Windows\system32\find.exe" "Teams.exe"Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\tasklist.exe tasklist /FI "USERNAME eq user" /FI "IMAGENAME eq Teams.exe" /FO csv Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\find.exe "C:\Windows\system32\find.exe" "Teams.exe"Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "powershell "$s=(New-Object -COM WScript.Shell).CreateShortcut('C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MyElectronApp.lnk');$s.TargetPath='C:\Users\user\AppData\Local\Programs\Teams\Teams.exe';$s.Save()""Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeProcess created: C:\Users\user\AppData\Local\Programs\Teams\Teams.exe "C:\Users\user\AppData\Local\Programs\Teams\Teams.exe" --type=gpu-process --user-data-dir="C:\Users\user\AppData\Roaming\Teams" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=1804,i,4916229494749615140,4144486409714305981,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=1796 /prefetch:2Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeProcess created: C:\Users\user\AppData\Local\Programs\Teams\Teams.exe "C:\Users\user\AppData\Local\Programs\Teams\Teams.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --user-data-dir="C:\Users\user\AppData\Roaming\Teams" --field-trial-handle=2464,i,4916229494749615140,4144486409714305981,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2416 /prefetch:3Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeProcess created: C:\Users\user\AppData\Local\Programs\Teams\Teams.exe "C:\Users\user\AppData\Local\Programs\Teams\Teams.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --user-data-dir="C:\Users\user\AppData\Roaming\Teams" --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=2548,i,4916229494749615140,4144486409714305981,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2544 /prefetch:8Jump to behavior
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell "$s=(New-Object -COM WScript.Shell).CreateShortcut('C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MyElectronApp.lnk');$s.TargetPath='C:\Users\user\AppData\Local\Programs\Teams\Teams.exe';$s.Save()"Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeProcess created: C:\Users\user\AppData\Local\Programs\Teams\Teams.exe "C:\Users\user\AppData\Local\Programs\Teams\Teams.exe" --type=gpu-process --user-data-dir="C:\Users\user\AppData\Roaming\Teams" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=1704,i,126123718397027599,14626746628952611418,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=1696 /prefetch:2
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "powershell "$s=(New-Object -COM WScript.Shell).CreateShortcut('C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MyElectronApp.lnk');$s.TargetPath='C:\Users\user\AppData\Local\Programs\Teams\Teams.exe';$s.Save()""
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeProcess created: C:\Users\user\AppData\Local\Programs\Teams\Teams.exe "C:\Users\user\AppData\Local\Programs\Teams\Teams.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --user-data-dir="C:\Users\user\AppData\Roaming\Teams" --field-trial-handle=2428,i,126123718397027599,14626746628952611418,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2424 /prefetch:3
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeProcess created: C:\Users\user\AppData\Local\Programs\Teams\Teams.exe "C:\Users\user\AppData\Local\Programs\Teams\Teams.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --user-data-dir="C:\Users\user\AppData\Roaming\Teams" --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=1200,i,126123718397027599,14626746628952611418,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2484 /prefetch:8
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell "$s=(New-Object -COM WScript.Shell).CreateShortcut('C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MyElectronApp.lnk');$s.TargetPath='C:\Users\user\AppData\Local\Programs\Teams\Teams.exe';$s.Save()"
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeProcess created: C:\Windows\System32\cmd.exe c:\windows\system32\cmd.exe /d /s /c "powershell "$s=(new-object -com wscript.shell).createshortcut('c:\users\user\appdata\roaming\microsoft\windows\start menu\programs\startup\myelectronapp.lnk');$s.targetpath='c:\users\user\appdata\local\programs\teams\teams.exe';$s.save()""
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeProcess created: C:\Users\user\AppData\Local\Programs\Teams\Teams.exe "c:\users\user\appdata\local\programs\teams\teams.exe" --type=gpu-process --user-data-dir="c:\users\user\appdata\roaming\teams" --gpu-preferences=uaaaaaaaaadgaaaeaaaaaaaaaaaaaaaaaabgaaeaaaaaaaaaaaaaaaaaaaacaaaaaaaaaaaaaaaaaaaaaaaaabaaaaaaaaaaeaaaaaaaaaaiaaaaaaaaaagaaaaaaaaa --field-trial-handle=1804,i,4916229494749615140,4144486409714305981,262144 --disable-features=sparerendererforsiteperprocess,windelayspellcheckserviceinit,winretrievesuggestionsonlyondemand --variations-seed-version --mojo-platform-channel-handle=1796 /prefetch:2
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeProcess created: C:\Users\user\AppData\Local\Programs\Teams\Teams.exe "c:\users\user\appdata\local\programs\teams\teams.exe" --type=utility --utility-sub-type=network.mojom.networkservice --lang=en-gb --service-sandbox-type=none --user-data-dir="c:\users\user\appdata\roaming\teams" --field-trial-handle=2464,i,4916229494749615140,4144486409714305981,262144 --disable-features=sparerendererforsiteperprocess,windelayspellcheckserviceinit,winretrievesuggestionsonlyondemand --variations-seed-version --mojo-platform-channel-handle=2416 /prefetch:3
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeProcess created: C:\Users\user\AppData\Local\Programs\Teams\Teams.exe "c:\users\user\appdata\local\programs\teams\teams.exe" --type=gpu-process --user-data-dir="c:\users\user\appdata\roaming\teams" --gpu-preferences=uaaaaaaaaadgaaaeaaaaaaaaaaaaaaaaaabgaaeaaaaaaaaaaaaaaaaaaaacaaaaaaaaaaaaaaaaaaaaaaaaabaaaaaaaaaaeaaaaaaaaaaiaaaaaaaaaagaaaaaaaaa --field-trial-handle=1704,i,126123718397027599,14626746628952611418,262144 --disable-features=sparerendererforsiteperprocess,windelayspellcheckserviceinit,winretrievesuggestionsonlyondemand --variations-seed-version --mojo-platform-channel-handle=1696 /prefetch:2
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeProcess created: C:\Windows\System32\cmd.exe c:\windows\system32\cmd.exe /d /s /c "powershell "$s=(new-object -com wscript.shell).createshortcut('c:\users\user\appdata\roaming\microsoft\windows\start menu\programs\startup\myelectronapp.lnk');$s.targetpath='c:\users\user\appdata\local\programs\teams\teams.exe';$s.save()""
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeProcess created: C:\Users\user\AppData\Local\Programs\Teams\Teams.exe "c:\users\user\appdata\local\programs\teams\teams.exe" --type=utility --utility-sub-type=network.mojom.networkservice --lang=en-gb --service-sandbox-type=none --user-data-dir="c:\users\user\appdata\roaming\teams" --field-trial-handle=2428,i,126123718397027599,14626746628952611418,262144 --disable-features=sparerendererforsiteperprocess,windelayspellcheckserviceinit,winretrievesuggestionsonlyondemand --variations-seed-version --mojo-platform-channel-handle=2424 /prefetch:3
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeProcess created: C:\Users\user\AppData\Local\Programs\Teams\Teams.exe "c:\users\user\appdata\local\programs\teams\teams.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --user-data-dir="c:\users\user\appdata\roaming\teams" --gpu-preferences=uaaaaaaaaadoaaaeaaaaaaaaaaaaaaaaaabgaaeaaaaaaaaaaaaaaaaaaabcaaaaaaaaaaaaaaaaaaaaaaaaabaaaaaaaaaaeaaaaaaaaaaiaaaaaaaaaagaaaaaaaaa --field-trial-handle=2548,i,4916229494749615140,4144486409714305981,262144 --disable-features=sparerendererforsiteperprocess,windelayspellcheckserviceinit,winretrievesuggestionsonlyondemand --variations-seed-version --mojo-platform-channel-handle=2544 /prefetch:8
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeProcess created: C:\Users\user\AppData\Local\Programs\Teams\Teams.exe "c:\users\user\appdata\local\programs\teams\teams.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --user-data-dir="c:\users\user\appdata\roaming\teams" --gpu-preferences=uaaaaaaaaadoaaaeaaaaaaaaaaaaaaaaaabgaaeaaaaaaaaaaaaaaaaaaabcaaaaaaaaaaaaaaaaaaaaaaaaabaaaaaaaaaaeaaaaaaaaaaiaaaaaaaaaagaaaaaaaaa --field-trial-handle=1200,i,126123718397027599,14626746628952611418,262144 --disable-features=sparerendererforsiteperprocess,windelayspellcheckserviceinit,winretrievesuggestionsonlyondemand --variations-seed-version --mojo-platform-channel-handle=2484 /prefetch:8
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeProcess created: C:\Windows\System32\cmd.exe c:\windows\system32\cmd.exe /d /s /c "powershell "$s=(new-object -com wscript.shell).createshortcut('c:\users\user\appdata\roaming\microsoft\windows\start menu\programs\startup\myelectronapp.lnk');$s.targetpath='c:\users\user\appdata\local\programs\teams\teams.exe';$s.save()""Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeProcess created: C:\Users\user\AppData\Local\Programs\Teams\Teams.exe "c:\users\user\appdata\local\programs\teams\teams.exe" --type=gpu-process --user-data-dir="c:\users\user\appdata\roaming\teams" --gpu-preferences=uaaaaaaaaadgaaaeaaaaaaaaaaaaaaaaaabgaaeaaaaaaaaaaaaaaaaaaaacaaaaaaaaaaaaaaaaaaaaaaaaabaaaaaaaaaaeaaaaaaaaaaiaaaaaaaaaagaaaaaaaaa --field-trial-handle=1804,i,4916229494749615140,4144486409714305981,262144 --disable-features=sparerendererforsiteperprocess,windelayspellcheckserviceinit,winretrievesuggestionsonlyondemand --variations-seed-version --mojo-platform-channel-handle=1796 /prefetch:2Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeProcess created: C:\Users\user\AppData\Local\Programs\Teams\Teams.exe "c:\users\user\appdata\local\programs\teams\teams.exe" --type=utility --utility-sub-type=network.mojom.networkservice --lang=en-gb --service-sandbox-type=none --user-data-dir="c:\users\user\appdata\roaming\teams" --field-trial-handle=2464,i,4916229494749615140,4144486409714305981,262144 --disable-features=sparerendererforsiteperprocess,windelayspellcheckserviceinit,winretrievesuggestionsonlyondemand --variations-seed-version --mojo-platform-channel-handle=2416 /prefetch:3Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeProcess created: C:\Users\user\AppData\Local\Programs\Teams\Teams.exe "c:\users\user\appdata\local\programs\teams\teams.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --user-data-dir="c:\users\user\appdata\roaming\teams" --gpu-preferences=uaaaaaaaaadoaaaeaaaaaaaaaaaaaaaaaabgaaeaaaaaaaaaaaaaaaaaaabcaaaaaaaaaaaaaaaaaaaaaaaaabaaaaaaaaaaeaaaaaaaaaaiaaaaaaaaaagaaaaaaaaa --field-trial-handle=2548,i,4916229494749615140,4144486409714305981,262144 --disable-features=sparerendererforsiteperprocess,windelayspellcheckserviceinit,winretrievesuggestionsonlyondemand --variations-seed-version --mojo-platform-channel-handle=2544 /prefetch:8Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeProcess created: C:\Users\user\AppData\Local\Programs\Teams\Teams.exe "c:\users\user\appdata\local\programs\teams\teams.exe" --type=gpu-process --user-data-dir="c:\users\user\appdata\roaming\teams" --gpu-preferences=uaaaaaaaaadgaaaeaaaaaaaaaaaaaaaaaabgaaeaaaaaaaaaaaaaaaaaaaacaaaaaaaaaaaaaaaaaaaaaaaaabaaaaaaaaaaeaaaaaaaaaaiaaaaaaaaaagaaaaaaaaa --field-trial-handle=1704,i,126123718397027599,14626746628952611418,262144 --disable-features=sparerendererforsiteperprocess,windelayspellcheckserviceinit,winretrievesuggestionsonlyondemand --variations-seed-version --mojo-platform-channel-handle=1696 /prefetch:2
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeProcess created: C:\Windows\System32\cmd.exe c:\windows\system32\cmd.exe /d /s /c "powershell "$s=(new-object -com wscript.shell).createshortcut('c:\users\user\appdata\roaming\microsoft\windows\start menu\programs\startup\myelectronapp.lnk');$s.targetpath='c:\users\user\appdata\local\programs\teams\teams.exe';$s.save()""
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeProcess created: C:\Users\user\AppData\Local\Programs\Teams\Teams.exe "c:\users\user\appdata\local\programs\teams\teams.exe" --type=utility --utility-sub-type=network.mojom.networkservice --lang=en-gb --service-sandbox-type=none --user-data-dir="c:\users\user\appdata\roaming\teams" --field-trial-handle=2428,i,126123718397027599,14626746628952611418,262144 --disable-features=sparerendererforsiteperprocess,windelayspellcheckserviceinit,winretrievesuggestionsonlyondemand --variations-seed-version --mojo-platform-channel-handle=2424 /prefetch:3
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeProcess created: C:\Users\user\AppData\Local\Programs\Teams\Teams.exe "c:\users\user\appdata\local\programs\teams\teams.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --user-data-dir="c:\users\user\appdata\roaming\teams" --gpu-preferences=uaaaaaaaaadoaaaeaaaaaaaaaaaaaaaaaabgaaeaaaaaaaaaaaaaaaaaaabcaaaaaaaaaaaaaaaaaaaaaaaaabaaaaaaaaaaeaaaaaaaaaaiaaaaaaaaaagaaaaaaaaa --field-trial-handle=1200,i,126123718397027599,14626746628952611418,262144 --disable-features=sparerendererforsiteperprocess,windelayspellcheckserviceinit,winretrievesuggestionsonlyondemand --variations-seed-version --mojo-platform-channel-handle=2484 /prefetch:8
Source: cMqyGFCQHk.exe, 00000000.00000003.2406907152.0000000006EF0000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: ..\..\third_party\webrtc\modules\desktop_capture\win\window_capture_utils.ccFail to create instance of VirtualDesktopManagerChrome_WidgetWin_Progman..\..\third_party\webrtc\modules\desktop_capture\cropping_window_capturer.ccWindow no longer on top when ScreenCapturer finishesScreenCapturer failed to capture a frameWindow rect is emptyWindow is outside of the captured displaySysShadowWebRTC.DesktopCapture.Win.WindowGdiCapturerFrameTime..\..\third_party\webrtc\modules\desktop_capture\win\window_capturer_win_gdi.ccWindow hasn't been selected: Target window has been closed.Failed to get drawable window area: Failed to get window DC: Failed to create frame.Both PrintWindow() and BitBlt() failed.Capturing owned window failed (previous error/warning pertained to that)WindowCapturerWinGdi::CaptureFrameWebRTC.DesktopCapture.BlankFrameDetectedWebRTC.DesktopCapture.PrimaryCapturerSelectSourceErrorWebRTC.DesktopCapture.PrimaryCapturerErrorWebRTC.DesktopCapture.PrimaryCapturerPermanentErrordwmapi.dllDwmEnableComposition..\..\third_party\webrtc\modules\desktop_capture\win\screen_capturer_win_gdi.ccFailed to capture screen by GDI.WebRTC.DesktopCapture.Win.ScreenGdiCapturerFrameTimedesktop_dc_memory_dc_Failed to get screen rect.Failed to create frame buffer.Failed to select current bitmap into memery dc.BitBlt failedScreenCapturerWinGdi::CaptureFrame..\..\third_party\webrtc\modules\desktop_capture\win\cursor.ccwebrtc::CreateMouseCursorFromHCursorUnable to get cursor icon info. Error = Unable to get bitmap info. Error = Unable to get bitmap bits. Error = `
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeRegistry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeRegistry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeRegistry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeRegistry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeQueries volume information: C:\ VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeQueries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeQueries volume information: C:\Windows\System32\spool\drivers\color\sRGB Color Space Profile.icm VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeQueries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeQueries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeQueries volume information: C:\Users\user VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeQueries volume information: C:\Users\user\AppData VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeQueries volume information: C:\Users\user\AppData\Roaming\Teams\Local State VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeQueries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeQueries volume information: C:\Users\user\AppData\Roaming\Teams\config.json VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeQueries volume information: C:\Users\user\AppData\Roaming\Teams\config.json VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeQueries volume information: C:\Windows\System32\spool\drivers\color\sRGB Color Space Profile.icm VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeQueries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation
Source: C:\Users\user\Desktop\cMqyGFCQHk.exeCode function: 0_2_0040338F EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,ExitProcess,CoUninitialize,ExitProcess,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,0_2_0040338F
Source: C:\Users\user\AppData\Local\Programs\Teams\Teams.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuidJump to behavior

Mitre Att&ck Matrix

ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
Gather Victim Identity InformationAcquire InfrastructureValid Accounts1
Windows Management Instrumentation		1
Windows Service		1
Access Token Manipulation		1
Masquerading		11
Input Capture		1
Security Software Discovery		Remote Services11
Input Capture		1
Encrypted Channel		Exfiltration Over Other Network Medium1
System Shutdown/Reboot
CredentialsDomainsDefault Accounts1
Command and Scripting Interpreter		12
Registry Run Keys / Startup Folder		1
Windows Service		21
Virtualization/Sandbox Evasion		LSASS Memory3
Process Discovery		Remote Desktop Protocol1
Archive Collected Data		Junk DataExfiltration Over BluetoothNetwork Denial of Service
Email AddressesDNS ServerDomain Accounts1
PowerShell		1
DLL Side-Loading		12
Process Injection		1
Access Token Manipulation		Security Account Manager21
Virtualization/Sandbox Evasion		SMB/Windows Admin Shares1
Clipboard Data		SteganographyAutomated ExfiltrationData Encrypted for Impact
Employee NamesVirtual Private ServerLocal AccountsCronLogin Hook12
Registry Run Keys / Startup Folder		12
Process Injection		NTDS1
Application Window Discovery		Distributed Component Object ModelInput CaptureProtocol ImpersonationTraffic DuplicationData Destruction
Gather Victim Network InformationServerCloud AccountsLaunchdNetwork Logon Script1
DLL Side-Loading		1
DLL Side-Loading		LSA Secrets1
Remote System Discovery		SSHKeyloggingFallback ChannelsScheduled TransferData Encrypted for Impact
Domain PropertiesBotnetReplication Through Removable MediaScheduled TaskRC ScriptsRC ScriptsSteganographyCached Domain Credentials3
File and Directory Discovery		VNCGUI Input CaptureMultiband CommunicationData Transfer Size LimitsService Stop
DNSWeb ServicesExternal Remote ServicesSystemd TimersStartup ItemsStartup ItemsCompile After DeliveryDCSync36
System Information Discovery		Windows Remote ManagementWeb Portal CaptureCommonly Used PortExfiltration Over C2 ChannelInhibit System Recovery

Behavior Graph

Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1556006 Sample: cMqyGFCQHk.exe Startdate: 14/11/2024 Architecture: WINDOWS Score: 60 59 Sigma detected: Powershell create lnk in startup 2->59 61 Sigma detected: Potential Startup Shortcut Persistence Via PowerShell.EXE 2->61 7 cMqyGFCQHk.exe 11 226 2->7         started        11 Teams.exe 4 2->11         started        13 Teams.exe 2->13         started        process3 file4 49 C:\Users\user\AppData\Local\...\Teams.exe, PE32+ 7->49 dropped 51 C:\Users\user\AppData\Local\...\nsis7z.dll, PE32 7->51 dropped 53 C:\Users\user\AppData\Local\...\nsExec.dll, PE32 7->53 dropped 55 17 other files (none is malicious) 7->55 dropped 63 Drops large PE files 7->63 15 cmd.exe 1 7->15         started        17 cmd.exe 1 11->17         started        19 Teams.exe 1 11->19         started        21 Teams.exe 11->21         started        23 Teams.exe 11->23         started        25 cmd.exe 13->25         started        27 Teams.exe 13->27         started        29 Teams.exe 13->29         started        31 Teams.exe 13->31         started        signatures5 process6 process7 33 conhost.exe 15->33         started        35 tasklist.exe 1 15->35         started        37 find.exe 1 15->37         started        39 powershell.exe 17 17->39         started        43 conhost.exe 17->43         started        45 conhost.exe 25->45         started        47 powershell.exe 25->47         started        file8 57 C:\Users\user\AppData\...\MyElectronApp.lnk, MS 39->57 dropped 65 Powershell creates an autostart link 39->65 signatures9

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.


windows-stand

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

SourceDetectionScannerLabelLink
cMqyGFCQHk.exe0%ReversingLabs

Dropped Files

SourceDetectionScannerLabelLink
C:\Users\user\AppData\Local\Programs\Teams\Teams.exe0%ReversingLabs
C:\Users\user\AppData\Local\Programs\Teams\d3dcompiler_47.dll0%ReversingLabs
C:\Users\user\AppData\Local\Programs\Teams\ffmpeg.dll0%ReversingLabs
C:\Users\user\AppData\Local\Programs\Teams\libEGL.dll0%ReversingLabs
C:\Users\user\AppData\Local\Programs\Teams\libGLESv2.dll0%ReversingLabs
C:\Users\user\AppData\Local\Temp\nshFAEA.tmp\7z-out\Teams.exe0%ReversingLabs
C:\Users\user\AppData\Local\Temp\nshFAEA.tmp\7z-out\d3dcompiler_47.dll0%ReversingLabs
C:\Users\user\AppData\Local\Temp\nshFAEA.tmp\7z-out\ffmpeg.dll0%ReversingLabs
C:\Users\user\AppData\Local\Temp\nshFAEA.tmp\7z-out\libEGL.dll0%ReversingLabs
C:\Users\user\AppData\Local\Temp\nshFAEA.tmp\7z-out\libGLESv2.dll0%ReversingLabs
C:\Users\user\AppData\Local\Temp\nshFAEA.tmp\7z-out\resources\app.asar.unpacked\node_modules\ps-list\vendor\fastlist-0.3.0-x64.exe0%ReversingLabs
C:\Users\user\AppData\Local\Temp\nshFAEA.tmp\7z-out\resources\app.asar.unpacked\node_modules\ps-list\vendor\fastlist-0.3.0-x86.exe0%ReversingLabs
C:\Users\user\AppData\Local\Temp\nshFAEA.tmp\7z-out\resources\elevate.exe0%ReversingLabs
C:\Users\user\AppData\Local\Temp\nshFAEA.tmp\7z-out\vk_swiftshader.dll0%ReversingLabs
C:\Users\user\AppData\Local\Temp\nshFAEA.tmp\7z-out\vulkan-1.dll0%ReversingLabs
C:\Users\user\AppData\Local\Temp\nshFAEA.tmp\SpiderBanner.dll0%ReversingLabs
C:\Users\user\AppData\Local\Temp\nshFAEA.tmp\StdUtils.dll0%ReversingLabs
C:\Users\user\AppData\Local\Temp\nshFAEA.tmp\System.dll0%ReversingLabs
C:\Users\user\AppData\Local\Temp\nshFAEA.tmp\nsExec.dll0%ReversingLabs
C:\Users\user\AppData\Local\Temp\nshFAEA.tmp\nsis7z.dll0%ReversingLabs

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

SourceDetectionScannerLabelLink
https://secure.travis-ci.org/troygoode/node-require-directory.png)0%Avira URL Cloudsafe
https://html.spec.whatwg.org/multipage/server-sent-events.html#server-sent-events.org/0%Avira URL Cloudsafe
http://fresc81.github.io/node-winreg0%Avira URL Cloudsafe
https://w3c.github.io/aria/#aria-hidden.0%Avira URL Cloudsafe
https://yargs.js.org/0%Avira URL Cloudsafe
https://nodei.co/npm/require-directory/)0%Avira URL Cloudsafe

Domains and IPs

Contacted Domains

NameIPActiveMaliciousAntivirus DetectionReputation
s-part-0017.t-0009.t-msedge.net
13.107.246.45
truefalse
    		high

    URLs from Memory and Binaries

    NameSourceMaliciousAntivirus DetectionReputation
    https://github.com/lgeiger/node-abi/issues/54cMqyGFCQHk.exe, 00000000.00000003.2304404903.00000000057F0000.00000004.00001000.00020000.00000000.sdmpfalse
      		high
      https://github.com/mcollina/reusify#readmecMqyGFCQHk.exe, 00000000.00000003.2304404903.00000000057F0000.00000004.00001000.00020000.00000000.sdmpfalse
        		high
        https://url.spec.whatwg.org/#concept-url-origincMqyGFCQHk.exe, 00000000.00000003.2304404903.00000000057F0000.00000004.00001000.00020000.00000000.sdmpfalse
          		high
          https://github.com/simplejson/simplejsoncMqyGFCQHk.exe, 00000000.00000003.2293258093.0000000005CF0000.00000004.00001000.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2418539279.0000000005197000.00000004.00000020.00020000.00000000.sdmpfalse
            		high
            https://tools.ietf.org/html/rfc6455#section-1.3cMqyGFCQHk.exe, 00000000.00000003.2406552229.0000000006AF0000.00000004.00001000.00020000.00000000.sdmpfalse
              		high
              https://support.google.com/chrome/answer/6098869cMqyGFCQHk.exe, 00000000.00000003.2479386329.0000000004C34000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2479792300.0000000004C34000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2480625633.0000000004C34000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2478846758.0000000004C34000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2481225639.0000000004C34000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2478185118.0000000004C34000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2480146293.0000000004C34000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2481468216.0000000004C34000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2477975318.0000000004C34000.00000004.00000020.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2478464913.0000000004C34000.00000004.00000020.00020000.00000000.sdmpfalse
                		high
                https://www.bluetooth.com/specifications/gatt/servicescMqyGFCQHk.exe, 00000000.00000003.2407447233.00000000073F3000.00000004.00001000.00020000.00000000.sdmpfalse
                  		high
                  https://github.com/prebuild/prebuild-installcMqyGFCQHk.exe, 00000000.00000003.2304404903.00000000057F0000.00000004.00001000.00020000.00000000.sdmpfalse
                    		high
                    https://github.com/vercel/pkg-fetch/actions/runs/2638965835cMqyGFCQHk.exe, 00000000.00000003.2304404903.00000000057F0000.00000004.00001000.00020000.00000000.sdmpfalse
                      		high
                      https://github.com/WebBluetoothCG/web-bluetooth/blob/main/implementation-status.mdcMqyGFCQHk.exe, 00000000.00000003.2407447233.00000000073F3000.00000004.00001000.00020000.00000000.sdmpfalse
                        		high
                        https://github.com/jesec/pkg-fetch/actions/runs/2639072106cMqyGFCQHk.exe, 00000000.00000003.2304404903.00000000057F0000.00000004.00001000.00020000.00000000.sdmpfalse
                          		high
                          https://github.com/feross/queue-microtaskcMqyGFCQHk.exe, 00000000.00000003.2304404903.00000000057F0000.00000004.00001000.00020000.00000000.sdmpfalse
                            		high
                            https://www.chromestatus.com/feature/5093566007214080cMqyGFCQHk.exe, 00000000.00000003.2407447233.00000000073F3000.00000004.00001000.00020000.00000000.sdmpfalse
                              		high
                              https://console.spec.whatwg.org/#tablecMqyGFCQHk.exe, 00000000.00000003.2406552229.0000000006AF0000.00000004.00001000.00020000.00000000.sdmpfalse
                                		high
                                https://github.com/nodejs/string_decodercMqyGFCQHk.exe, 00000000.00000003.2304404903.00000000057F0000.00000004.00001000.00020000.00000000.sdmpfalse
                                  		high
                                  https://secure.travis-ci.org/troygoode/node-require-directory.png)cMqyGFCQHk.exe, 00000000.00000003.2304404903.00000000057F0000.00000004.00001000.00020000.00000000.sdmpfalse
                                  • Avira URL Cloud: safe
                                  		unknown
                                  https://encoding.spec.whatwg.org/#textencodercMqyGFCQHk.exe, 00000000.00000003.2406552229.0000000006AF0000.00000004.00001000.00020000.00000000.sdmpfalse
                                    		high
                                    https://chrome.google.com/webstore?hl=pl&category=theme81https://myactivity.google.com/myactivity/?ucMqyGFCQHk.exe, 00000000.00000003.2480625633.0000000004C34000.00000004.00000020.00020000.00000000.sdmpfalse
                                      		high
                                      https://www.patreon.com/ferosscMqyGFCQHk.exe, 00000000.00000003.2304404903.00000000057F0000.00000004.00001000.00020000.00000000.sdmpfalse
                                        		high
                                        https://github.com/tc39/proposal-weakrefscMqyGFCQHk.exe, 00000000.00000003.2406552229.0000000006AF0000.00000004.00001000.00020000.00000000.sdmpfalse
                                          		high
                                          https://goo.gl/t5IS6M).cMqyGFCQHk.exe, 00000000.00000003.2406907152.0000000006EF0000.00000004.00001000.00020000.00000000.sdmpfalse
                                            		high
                                            https://github.com/vercel/pkg-fetch/actions/runs/2638965968cMqyGFCQHk.exe, 00000000.00000003.2304404903.00000000057F0000.00000004.00001000.00020000.00000000.sdmpfalse
                                              		high
                                              https://github.com/nodejs/node/issues/44985cMqyGFCQHk.exe, 00000000.00000003.2406552229.0000000006AF0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                		high
                                                https://github.com/google/caja/blob/HEAD/src/com/google/caja/ses/repairES5.jscMqyGFCQHk.exe, 00000000.00000003.2406552229.0000000006AF0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                  		high
                                                  https://url.spec.whatwg.org/#concept-urlencoded-serializercMqyGFCQHk.exe, 00000000.00000003.2406552229.0000000006AF0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                    		high
                                                    https://url.spec.whatwg.org/#dom-urlsearchparams-urlsearchparamscMqyGFCQHk.exe, 00000000.00000003.2406552229.0000000006AF0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                      		high
                                                      https://yargs.js.org/cMqyGFCQHk.exe, 00000000.00000003.2304404903.00000000057F0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                      • Avira URL Cloud: safe
                                                      		unknown
                                                      https://semver.org/cMqyGFCQHk.exe, 00000000.00000003.2304404903.00000000057F0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                        		high
                                                        https://github.com/google/pprof/tree/master/protocMqyGFCQHk.exe, 00000000.00000003.2293258093.0000000005CF0000.00000004.00001000.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2418539279.0000000005197000.00000004.00000020.00020000.00000000.sdmpfalse
                                                          		high
                                                          https://github.com/jrmuizel/qcms/tree/v4cMqyGFCQHk.exe, 00000000.00000003.2293258093.0000000005CF0000.00000004.00001000.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2418539279.0000000005197000.00000004.00000020.00020000.00000000.sdmpfalse
                                                            		high
                                                            https://nodejs.org/api/fs.htmlcMqyGFCQHk.exe, 00000000.00000003.2406552229.0000000006AF0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                              		high
                                                              https://npmjs.org/package/require-directory))cMqyGFCQHk.exe, 00000000.00000003.2304404903.00000000057F0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                		high
                                                                https://chromium.googlesource.com/chromium/src/cMqyGFCQHk.exe, 00000000.00000003.2407447233.00000000073F3000.00000004.00001000.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2293258093.0000000005CF0000.00000004.00001000.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2418539279.0000000005197000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                  		high
                                                                  https://w3c.github.io/manifest/#installability-signalscMqyGFCQHk.exe, 00000000.00000003.2407447233.00000000073F3000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                    		high
                                                                    http://www.midnight-commander.org/browser/lib/tty/key.ccMqyGFCQHk.exe, 00000000.00000003.2406552229.0000000006AF0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                      		high
                                                                      https://nodejs.org/cMqyGFCQHk.exe, 00000000.00000003.2406552229.0000000006AF0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                        		high
                                                                        https://tools.ietf.org/html/rfc7540#section-8.1.2.5cMqyGFCQHk.exe, 00000000.00000003.2406552229.0000000006AF0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                          		high
                                                                          http://exslt.org/commoncMqyGFCQHk.exe, 00000000.00000003.2407447233.00000000073F3000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                            		high
                                                                            https://github.com/KhronosGroup/SPIRV-Headers.gitcMqyGFCQHk.exe, 00000000.00000003.2293258093.0000000005CF0000.00000004.00001000.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2418539279.0000000005197000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                              		high
                                                                              https://tc39.es/ecma262/#sec-timeclipcMqyGFCQHk.exe, 00000000.00000003.2406552229.0000000006AF0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                		high
                                                                                https://nodei.co/npm/require-directory/)cMqyGFCQHk.exe, 00000000.00000003.2304404903.00000000057F0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                • Avira URL Cloud: safe
                                                                                		unknown
                                                                                https://github.com/nodejs/node/pull/33661cMqyGFCQHk.exe, 00000000.00000003.2406552229.0000000006AF0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                  		high
                                                                                  https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/String/endsWithcMqyGFCQHk.exe, 00000000.00000003.2304404903.00000000057F0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                    		high
                                                                                    https://github.com/WICG/scheduling-apiscMqyGFCQHk.exe, 00000000.00000003.2406907152.0000000006EF0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                      		high
                                                                                      https://github.com/nodejs/node/pull/48477#issuecomment-1604586650cMqyGFCQHk.exe, 00000000.00000003.2406552229.0000000006AF0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                        		high
                                                                                        https://pypi.org/project/pyparsingcMqyGFCQHk.exe, 00000000.00000003.2293258093.0000000005CF0000.00000004.00001000.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2418539279.0000000005197000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                          		high
                                                                                          https://code.google.com/p/v8/wiki/JavaScriptStackTraceApicMqyGFCQHk.exe, 00000000.00000003.2304404903.00000000057F0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                            		high
                                                                                            https://code.google.com/p/chromium/issues/detail?id=25916cMqyGFCQHk.exe, 00000000.00000003.2406907152.0000000006EF0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                              		high
                                                                                              https://webidl.spec.whatwg.org/#abstract-opdef-converttointcMqyGFCQHk.exe, 00000000.00000003.2406552229.0000000006AF0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                		high
                                                                                                http://www.opensource.org/licenses/mit-license.php)cMqyGFCQHk.exe, 00000000.00000003.2304404903.00000000057F0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                  		high
                                                                                                  http://stackoverflow.com/a/1068308/13216cMqyGFCQHk.exe, 00000000.00000003.2304404903.00000000057F0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                    		high
                                                                                                    https://github.com/jesec/pkg-fetch/actions/runs/2639072371cMqyGFCQHk.exe, 00000000.00000003.2304404903.00000000057F0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                      		high
                                                                                                      https://twitter.com/intent/user?screen_name=troygoode)cMqyGFCQHk.exe, 00000000.00000003.2304404903.00000000057F0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                        		high
                                                                                                        https://fetch.spec.whatwg.org/#fetch-timing-infocMqyGFCQHk.exe, 00000000.00000003.2406552229.0000000006AF0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                          		high
                                                                                                          https://html.spec.whatwg.org/multipage/server-sent-events.html#server-sent-events.org/cMqyGFCQHk.exe, 00000000.00000003.2406552229.0000000006AF0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                          • Avira URL Cloud: safe
                                                                                                          		unknown
                                                                                                          https://github.com/libuv/libuv/pull/1088cMqyGFCQHk.exe, 00000000.00000003.2304404903.00000000057F0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                            		high
                                                                                                            https://github.com/nodejs/node/pull/12607cMqyGFCQHk.exe, 00000000.00000003.2406552229.0000000006AF0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                              		high
                                                                                                              https://html.spec.whatwg.org/multipage/webappapis.html#windoworworkerglobalscope.cMqyGFCQHk.exe, 00000000.00000003.2406552229.0000000006AF0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                		high
                                                                                                                https://www.ecma-international.org/ecma-262/#sec-line-terminatorscMqyGFCQHk.exe, 00000000.00000003.2406552229.0000000006AF0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                  		high
                                                                                                                  http://fresc81.github.io/node-winregcMqyGFCQHk.exe, 00000000.00000003.2304404903.00000000057F0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                  • Avira URL Cloud: safe
                                                                                                                  		unknown
                                                                                                                  https://developer.chrome.com/docs/extensions/mv3/service_workers/events/ScriptcMqyGFCQHk.exe, 00000000.00000003.2407447233.00000000073F3000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                    		high
                                                                                                                    https://www.unicode.org/Public/UNIDATA/EastAsianWidth.txtcMqyGFCQHk.exe, 00000000.00000003.2406552229.0000000006AF0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                      		high
                                                                                                                      https://sizzlejs.com/cMqyGFCQHk.exe, 00000000.00000003.2293258093.0000000005CF0000.00000004.00001000.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2418539279.0000000005197000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                        		high
                                                                                                                        https://medium.com/cMqyGFCQHk.exe, 00000000.00000003.2304404903.00000000057F0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                          		high
                                                                                                                          http://www.portaudio.comcMqyGFCQHk.exe, 00000000.00000003.2293258093.0000000005CF0000.00000004.00001000.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2418539279.0000000005197000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                            		high
                                                                                                                            https://github.com/ChromeDevTools/devtools-frontend/blob/4275917f84266ef40613db3c1784a25f902ea74e/frcMqyGFCQHk.exe, 00000000.00000003.2406552229.0000000006AF0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                              		high
                                                                                                                              https://beacons.gcp.gvt2.com/domainreliability/uploadcMqyGFCQHk.exe, 00000000.00000003.2407447233.00000000073F3000.00000004.00001000.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2406907152.0000000007248000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                		high
                                                                                                                                https://github.com/inspect-js/node-supports-preserve-symlinks-flag.gitcMqyGFCQHk.exe, 00000000.00000003.2304404903.00000000057F0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                  		high
                                                                                                                                  https://github.com/vercel/pkg-fetch/actions/runs/2068735040cMqyGFCQHk.exe, 00000000.00000003.2304404903.00000000057F0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                    		high
                                                                                                                                    https://github.com/vercel/pkg-fetch/actions/runs/752615557cMqyGFCQHk.exe, 00000000.00000003.2304404903.00000000057F0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                      		high
                                                                                                                                      https://github.com/RyanZim/universalify.gitcMqyGFCQHk.exe, 00000000.00000003.2304404903.00000000057F0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                        		high
                                                                                                                                        https://w3c.github.io/aria/#aria-hidden.cMqyGFCQHk.exe, 00000000.00000003.2406907152.0000000006EF0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                        • Avira URL Cloud: safe
                                                                                                                                        		unknown
                                                                                                                                        https://developer.chrome.com/docs/extensions/mv3/cross-origin-isolation/.cMqyGFCQHk.exe, 00000000.00000003.2406907152.0000000006EF0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                          		high
                                                                                                                                          https://github.com/WICG/construct-stylesheets/issues/119#issuecomment-588352418.cMqyGFCQHk.exe, 00000000.00000003.2406907152.0000000006EF0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                            		high
                                                                                                                                            https://github.com/google/shell-encryptioncMqyGFCQHk.exe, 00000000.00000003.2293258093.0000000005CF0000.00000004.00001000.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2418539279.0000000005197000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                              		high
                                                                                                                                              https://heycam.github.io/webidl/#es-iterable-entriescMqyGFCQHk.exe, 00000000.00000003.2406552229.0000000006AF0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                		high
                                                                                                                                                https://heycam.github.io/webidl/#es-interfacescMqyGFCQHk.exe, 00000000.00000003.2406552229.0000000006AF0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                  		high
                                                                                                                                                  https://unpkg.com/cliuicMqyGFCQHk.exe, 00000000.00000003.2304404903.00000000057F0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                    		high
                                                                                                                                                    https://github.com/nodejs/node/issuescMqyGFCQHk.exe, 00000000.00000003.2406552229.0000000006AF0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                      		high
                                                                                                                                                      https://github.com/denoland/deno/blob/main/LICENSE.md.cMqyGFCQHk.exe, 00000000.00000003.2406552229.0000000006AF0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                        		high
                                                                                                                                                        https://goo.gl/4NeimXOrigincMqyGFCQHk.exe, 00000000.00000003.2407447233.00000000073F3000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                          		high
                                                                                                                                                          https://encoding.spec.whatwg.org/#encode-and-enqueue-a-chunkcMqyGFCQHk.exe, 00000000.00000003.2406552229.0000000006AF0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                            		high
                                                                                                                                                            https://tc39.github.io/ecma262/#sec-object.prototype.tostringcMqyGFCQHk.exe, 00000000.00000003.2406552229.0000000006AF0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                              		high
                                                                                                                                                              https://url.spec.whatwg.org/#urlsearchparamscMqyGFCQHk.exe, 00000000.00000003.2406552229.0000000006AF0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                                		high
                                                                                                                                                                https://github.com/nodejs/node/issues/8987cMqyGFCQHk.exe, 00000000.00000003.2304404903.00000000057F0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                                  		high
                                                                                                                                                                  https://github.com/vercel/pkg-fetch/actions/runs/752615423cMqyGFCQHk.exe, 00000000.00000003.2304404903.00000000057F0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                                    		high
                                                                                                                                                                    https://chromeenterprise.google/policies/#BrowserSwitcherUrlListcMqyGFCQHk.exe, 00000000.00000003.2478846758.0000000004C34000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                      		high
                                                                                                                                                                      https://streams.spec.whatwg.org/#example-manual-write-with-backpressurecMqyGFCQHk.exe, 00000000.00000003.2406552229.0000000006AF0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                                        		high
                                                                                                                                                                        https://github.com/nodejs/node/pull/30380#issuecomment-552948364cMqyGFCQHk.exe, 00000000.00000003.2406552229.0000000006AF0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                                          		high
                                                                                                                                                                          https://html.spec.whatwg.org/multipage/timers-and-user-prompts.html#dom-setintervalcMqyGFCQHk.exe, 00000000.00000003.2406907152.0000000006EF0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                                            		high
                                                                                                                                                                            https://www.khronos.org/registry/cMqyGFCQHk.exe, 00000000.00000003.2293258093.0000000005CF0000.00000004.00001000.00020000.00000000.sdmp, cMqyGFCQHk.exe, 00000000.00000003.2418539279.0000000005197000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                              		high
                                                                                                                                                                              https://github.com/sponsors/ferosscMqyGFCQHk.exe, 00000000.00000003.2304404903.00000000057F0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                                                		high
                                                                                                                                                                                https://heycam.github.io/webidl/#dfn-iterator-prototype-objectcMqyGFCQHk.exe, 00000000.00000003.2406552229.0000000006AF0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                                                  		high
                                                                                                                                                                                  https://datatracker.ietf.org/doc/html/rfc7238cMqyGFCQHk.exe, 00000000.00000003.2406552229.0000000006AF0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                                                    		high
                                                                                                                                                                                    https://android.com/paycMqyGFCQHk.exe, 00000000.00000003.2407447233.00000000073F3000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                                                      		high
                                                                                                                                                                                      https://github.com/nodejs/node/pull/38614)cMqyGFCQHk.exe, 00000000.00000003.2406552229.0000000006AF0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                                                        		high
                                                                                                                                                                                        https://chrome.google.com/webstore?hl=hu&category=theme81https://myactivity.google.com/myactivity/?ucMqyGFCQHk.exe, 00000000.00000003.2479386329.0000000004C34000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                          		high
                                                                                                                                                                                          https://github.com/nodejs/node/issues/10673cMqyGFCQHk.exe, 00000000.00000003.2406552229.0000000006AF0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                                                            		high
                                                                                                                                                                                            https://xhr.spec.whatwg.org/.cMqyGFCQHk.exe, 00000000.00000003.2406907152.0000000006EF0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                                                              		high
                                                                                                                                                                                              https://www.chromestatus.com/feature/6662647093133312cMqyGFCQHk.exe, 00000000.00000003.2407447233.00000000073F3000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                                                                		high

                                                                                                                                                                                                World Map of Contacted IPs

                                                                                                                                                                                                ⊘No contacted IP infos

                                                                                                                                                                                                General Information

                                                                                                                                                                                                Joe Sandbox version:41.0.0 Charoite
                                                                                                                                                                                                Analysis ID:1556006
                                                                                                                                                                                                Start date and time:2024-11-14 19:54:17 +01:00
                                                                                                                                                                                                Joe Sandbox product:CloudBasic
                                                                                                                                                                                                Overall analysis duration:0h 9m 59s
                                                                                                                                                                                                Hypervisor based Inspection enabled:false
                                                                                                                                                                                                Report type:full
                                                                                                                                                                                                Cookbook file name:default.jbs
                                                                                                                                                                                                Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
                                                                                                                                                                                                Run name:Run with higher sleep bypass
                                                                                                                                                                                                Number of analysed new started processes analysed:26
                                                                                                                                                                                                Number of new started drivers analysed:0
                                                                                                                                                                                                Number of existing processes analysed:0
                                                                                                                                                                                                Number of existing drivers analysed:0
                                                                                                                                                                                                Number of injected processes analysed:0
                                                                                                                                                                                                Technologies:
                                                                                                                                                                                                • HCA enabled
                                                                                                                                                                                                • EGA enabled
                                                                                                                                                                                                • AMSI enabled
                                                                                                                                                                                                Analysis Mode:default
                                                                                                                                                                                                Analysis stop reason:Timeout
                                                                                                                                                                                                Sample name:cMqyGFCQHk.exe
                                                                                                                                                                                                renamed because original name is a hash value
                                                                                                                                                                                                Original Sample Name:3c3f458400c557d279c4d4993f67adc8ba3da4bad8fc844adfef8c7de475a1f7.exe
                                                                                                                                                                                                Detection:MAL
                                                                                                                                                                                                Classification:mal60.spre.winEXE@32/110@0/0
                                                                                                                                                                                                EGA Information:
                                                                                                                                                                                                • Successful, ratio: 100%
                                                                                                                                                                                                HCA Information:
                                                                                                                                                                                                • Successful, ratio: 100%
                                                                                                                                                                                                • Number of executed functions: 40
                                                                                                                                                                                                • Number of non-executed functions: 27
                                                                                                                                                                                                Cookbook Comments:
                                                                                                                                                                                                • Found application associated with file extension: .exe
                                                                                                                                                                                                • Sleeps bigger than 100000000ms are automatically reduced to 1000ms
                                                                                                                                                                                                • Sleep loops longer than 100000000ms are bypassed. Single calls with delay of 100000000ms and higher are ignored

                                                                                                                                                                                                Warnings

                                                                                                                                                                                                • Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
                                                                                                                                                                                                • Excluded domains from analysis (whitelisted): www.bing.com, client.wns.windows.com, fs.microsoft.com, ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, otelrules.afd.azureedge.net, ctldl.windowsupdate.com, azureedge-t-prod.trafficmanager.net, fe3cr.delivery.mp.microsoft.com
                                                                                                                                                                                                • Not all processes where analyzed, report is missing behavior information
                                                                                                                                                                                                • Report size exceeded maximum capacity and may have missing behavior information.
                                                                                                                                                                                                • Report size getting too big, too many NtOpenKeyEx calls found.
                                                                                                                                                                                                • Report size getting too big, too many NtProtectVirtualMemory calls found.
                                                                                                                                                                                                • Report size getting too big, too many NtQueryValueKey calls found.
                                                                                                                                                                                                • Report size getting too big, too many NtQueryVolumeInformationFile calls found.
                                                                                                                                                                                                • VT rate limit hit for: cMqyGFCQHk.exe

                                                                                                                                                                                                Simulations

                                                                                                                                                                                                Behavior and APIs

                                                                                                                                                                                                TimeTypeDescription
                                                                                                                                                                                                19:55:51AutostartRun: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MyElectronApp.lnk

                                                                                                                                                                                                Joe Sandbox View / Context

                                                                                                                                                                                                IPs

                                                                                                                                                                                                ⊘No context

                                                                                                                                                                                                Domains

                                                                                                                                                                                                MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                                                                                                                s-part-0017.t-0009.t-msedge.netfile.exeGet hashmaliciousLummaC, Amadey, LummaC Stealer, Stealc, VidarBrowse
                                                                                                                                                                                                • 13.107.246.45
                                                                                                                                                                                                http://loop.net.pk/cos.htmlGet hashmaliciousHTMLPhisher, Mamba2FABrowse
                                                                                                                                                                                                • 13.107.246.45
                                                                                                                                                                                                https://www.google.it/url?q=https://www.google.ro/url?q=https://www.google.nl/url?q=ZFCKQSES42J831UCOWMB4MEAK36T3IE7YuQiApLjODz3yh4nNeW8uuQi&rct=XS%25RANDOM4%25wDnNeW8yycT&sa=t&esrc=nNeW8F%25RANDOM3%25A0xys8Em2FL&source=&cd=tS6T8%25RANDOM3%25Tiw9XH&cad=XpPkDfJX%25RANDOM4%25VS0Y&ved=xjnktlqryYWwZIBRrgvK&uact=&url=amp/graylinelaketahoe.com&c=E,1,BWhR2At2OZAdw2Kzdn7d-U-fLZRdgzpdTFbcA87JOQxek-SzsLBqKBG-KMVpA5JovWFRbO4mN3q2zPe1YDaTOG57b4G9v05-IgsJXqrG4om_58_65Os9ldlZ&typo=1Get hashmaliciousUnknownBrowse
                                                                                                                                                                                                • 13.107.246.45
                                                                                                                                                                                                http://samobile.net/content/offsite_article.html?url=https%3A%2F%2Fsepedatua.com%2F158983%2Fsecure-redirect%23cnichols%2Bderickdermatology.com&headline=New+Jerusalem%2C+The+by+Chesterton%2C+G.+KGet hashmaliciousCaptcha PhishBrowse
                                                                                                                                                                                                • 13.107.246.45
                                                                                                                                                                                                file.exeGet hashmaliciousLummaCBrowse
                                                                                                                                                                                                • 13.107.246.45
                                                                                                                                                                                                file.exeGet hashmaliciousStealcBrowse
                                                                                                                                                                                                • 13.107.246.45
                                                                                                                                                                                                https://forms.office.com/Pages/ShareFormPage.aspx?id=xW69F1aTs06UvACEsnZeONWs3ov4-fZJk9ZDjpIIN5tUMUFMSUpJVVFUWEtHTFlURVNUWE1QV1hXQi4u&sharetoken=2Z2A4vYPJAA4bBGx5zDgGet hashmaliciousHTMLPhisherBrowse
                                                                                                                                                                                                • 13.107.246.45
                                                                                                                                                                                                Voice Msg Gail.gorman.htmlGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                • 13.107.246.45
                                                                                                                                                                                                file.exeGet hashmaliciousLummaCBrowse
                                                                                                                                                                                                • 13.107.246.45
                                                                                                                                                                                                https://ctrk.klclick.com/l/01JCNJ0H48YX46QX141C2JGKTY_0Get hashmaliciousHTMLPhisherBrowse
                                                                                                                                                                                                • 13.107.246.45

                                                                                                                                                                                                ASNs

                                                                                                                                                                                                ⊘No context

                                                                                                                                                                                                JA3 Fingerprints

                                                                                                                                                                                                ⊘No context

                                                                                                                                                                                                Dropped Files

                                                                                                                                                                                                MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                                                                                                                C:\Users\user\AppData\Local\Programs\Teams\d3dcompiler_47.dllSoltix.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                  Soltix.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                    Prismifyr_Installer_v2.1 Setup 1.0.0.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                      Prismifyr_Installer_v2.1 Setup 1.0.0.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                        Prismifyr_Installer_v2.1 Setup 1.0.0.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                          Prismifyr_Installer_v2.1 Setup 1.0.0.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                            svchost.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                              JaborSetup.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                ArenaWarsSetup.exeGet hashmaliciousUnknownBrowse

                                                                                                                                                                                                                  Created / dropped Files

                                                                                                                                                                                                                  C:\Users\user\AppData\Local\D3DSCache\a3119b5958838383\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.idx

                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Programs\Teams\Teams.exe
                                                                                                                                                                                                                  File Type:data
                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                  Size (bytes):65552
                                                                                                                                                                                                                  Entropy (8bit):0.012618579311362982
                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                  SSDEEP:3:BlllGlll/l/lXp9ZjrPBY0HlGltPoRP:Dl0dPBY0ogJ
                                                                                                                                                                                                                  MD5:473BCCBF062D91F7176E32EB7C029304
                                                                                                                                                                                                                  SHA1:9CDD8F7BD57A97DBB840EEC76A40304847399A9C
                                                                                                                                                                                                                  SHA-256:FB981B16172DB8F963D3B0370809DDD2C7455A18B264E45EA971FEFDAA3B05D9
                                                                                                                                                                                                                  SHA-512:FA502C363170AC68853A3F1BB4F1BDF892416523EFF765F0036F29FD120641909E3E53A0972C7F0B2EA70E1CCCCB5B62F45E94E446D2CB48BBBE5898EF4B7B4C
                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                  Preview:./.F........................................f...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                  C:\Users\user\AppData\Local\D3DSCache\a3119b5958838383\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.lock

                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Programs\Teams\Teams.exe
                                                                                                                                                                                                                  File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                  Category:modified
                                                                                                                                                                                                                  Size (bytes):4
                                                                                                                                                                                                                  Entropy (8bit):1.5
                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                  SSDEEP:3:R:R
                                                                                                                                                                                                                  MD5:F49655F856ACB8884CC0ACE29216F511
                                                                                                                                                                                                                  SHA1:CB0F1F87EC0455EC349AAA950C600475AC7B7B6B
                                                                                                                                                                                                                  SHA-256:7852FCE59C67DDF1D6B8B997EAA1ADFAC004A9F3A91C37295DE9223674011FBA
                                                                                                                                                                                                                  SHA-512:599E93D25B174524495ED29653052B3590133096404873318F05FD68F4C9A5C9A3B30574551141FBB73D7329D6BE342699A17F3AE84554BAB784776DFDA2D5F8
                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                  Preview:EERF

                                                                                                                                                                                                                  C:\Users\user\AppData\Local\D3DSCache\a3119b5958838383\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.val

                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Programs\Teams\Teams.exe
                                                                                                                                                                                                                  File Type:Matlab v4 mat-file (little endian) (, numeric, rows 0, columns 16, imaginary
                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                  Size (bytes):65536
                                                                                                                                                                                                                  Entropy (8bit):0.02608684396763992
                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                  SSDEEP:3:9llhd2DJqojrGjLlAdVdhOEjlpQlyEXl1lAbl7JIlWJIlWBttPllaia9sVQMm6En:g9q0XXUEZ+lX1IbRGlWGlWBtr2Hrn
                                                                                                                                                                                                                  MD5:61BA9C280BC6CC21B7E98426D8172803
                                                                                                                                                                                                                  SHA1:42EBF89EB4F90F8833B3D69C36E1DA0E4B679409
                                                                                                                                                                                                                  SHA-256:4F2A5535D6FE89E4D85945FDFDA94DFC8B2F4DA02B571862F95C93CA3C327238
                                                                                                                                                                                                                  SHA-512:E995153BE0BF4C292E7BD492D6E029ADAB68E7A2F9507A704483C3755354DB210B5E90EBCF3FDA4ADC6F60A973E3AA74AB9C1DF0D5C0E2641F3051E0DF74E860
                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                  Preview:................r...(....x:no.&A.e.u~+..C.:.\.U.s.e.r.s.\.e.n.g.i.n.e.e.r.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.P.r.o.g.r.a.m.s.\.T.e.a.m.s.\.T.e.a.m.s...e.x.e.............................(...p.DJ!.IL.....Zm.F............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                  C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                  Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                  File Type:data
                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                  Size (bytes):64
                                                                                                                                                                                                                  Entropy (8bit):0.34726597513537405
                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                  SSDEEP:3:Nlll:Nll
                                                                                                                                                                                                                  MD5:446DD1CF97EABA21CF14D03AEBC79F27
                                                                                                                                                                                                                  SHA1:36E4CC7367E0C7B40F4A8ACE272941EA46373799
                                                                                                                                                                                                                  SHA-256:A7DE5177C68A64BD48B36D49E2853799F4EBCFA8E4761F7CC472F333DC5F65CF
                                                                                                                                                                                                                  SHA-512:A6D754709F30B122112AE30E5AB22486393C5021D33DA4D1304C061863D2E1E79E8AEB029CAE61261BB77D0E7BECD53A7B0106D6EA4368B4C302464E3D941CF7
                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                  Preview:@...e...........................................................

                                                                                                                                                                                                                  C:\Users\user\AppData\Local\Programs\Teams\LICENSE.electron.txt

                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                  Process:C:\Users\user\Desktop\cMqyGFCQHk.exe
                                                                                                                                                                                                                  File Type:ASCII text
                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                  Size (bytes):1096
                                                                                                                                                                                                                  Entropy (8bit):5.13006727705212
                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                  SSDEEP:24:36DiJHxRHuyPP3GtIHw1Gg9QH+sUW8Ok4F+d1o36qjFD:36DiJzfPvGt7ICQH+sfIte36AFD
                                                                                                                                                                                                                  MD5:4D42118D35941E0F664DDDBD83F633C5
                                                                                                                                                                                                                  SHA1:2B21EC5F20FE961D15F2B58EFB1368E66D202E5C
                                                                                                                                                                                                                  SHA-256:5154E165BD6C2CC0CFBCD8916498C7ABAB0497923BAFCD5CB07673FE8480087D
                                                                                                                                                                                                                  SHA-512:3FFBBA2E4CD689F362378F6B0F6060571F57E228D3755BDD308283BE6CBBEF8C2E84BEB5FCF73E0C3C81CD944D01EE3FCF141733C4D8B3B0162E543E0B9F3E63
                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                  Preview:Copyright (c) Electron contributors.Copyright (c) 2013-2020 GitHub Inc...Permission is hereby granted, free of charge, to any person obtaining.a copy of this software and associated documentation files (the."Software"), to deal in the Software without restriction, including.without limitation the rights to use, copy, modify, merge, publish,.distribute, sublicense, and/or sell copies of the Software, and to.permit persons to whom the Software is furnished to do so, subject to.the following conditions:..The above copyright notice and this permission notice shall be.included in all copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,.EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND.NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE.LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION.OF CONTRACT, TORT OR OTHERWISE, ARISIN

                                                                                                                                                                                                                  C:\Users\user\AppData\Local\Programs\Teams\LICENSES.chromium.html

                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                  Process:C:\Users\user\Desktop\cMqyGFCQHk.exe
                                                                                                                                                                                                                  File Type:HTML document, ASCII text
                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                  Size (bytes):9099045
                                                                                                                                                                                                                  Entropy (8bit):4.754770173605162
                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                  SSDEEP:24576:2o9dQ06p6j6j1WOwRiXjYmfy6k6mjK64jK6gjK6e6cjK6feGjl8PpE:BFOeGT
                                                                                                                                                                                                                  MD5:6FF57C0AECCDF44C39C95DEE9ECEA805
                                                                                                                                                                                                                  SHA1:C76669A1354067A1C3DDBC032E66C323286A8D43
                                                                                                                                                                                                                  SHA-256:0BA4C7B781E9F149195A23D3BE0F704945F858A581871A9FEDD353F12CE839CA
                                                                                                                                                                                                                  SHA-512:D6108E1D1D52AA3199FF051C7B951025DBF51C5CB18E8920304116DCEF567367ED682245900FDA3AD354C5D50AA5A3C4E6872570A839A3A55D3A9B7579BDFA24
                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                  Preview: Generated by licenses.py; do not edit. --><!doctype html>.<html>.<head>.<meta charset="utf-8">.<meta name="viewport" content="width=device-width">.<meta name="color-scheme" content="light dark">.<title>Credits</title>.<link rel="stylesheet" href="chrome://resources/css/text_defaults.css">.<link rel="stylesheet" href="chrome://credits/credits.css">.</head>.<body>.<span class="page-title">Credits</span>.<a id="print-link" href="#" hidden>Print</a>.<label class="show show-all" tabindex="0">.<input type="checkbox" hidden>.</label>.<div class="open-sourced">. Chromium software is made available as source code. <a href="https://source.chromium.org/chromium">here</a>..</div>..<div style="clear:both; overflow:auto;"> Chromium <3s the following projects -->.<div class="product">.<span class="title">2-dim General Purpose FFT (Fast Fourier/Cosine/Sine Transform) Package</span>.<span class="homepage"><a href="http://www.kurims.kyoto-u.ac.jp/~ooura/fft.html">homepage</a></span>.<labe

                                                                                                                                                                                                                  C:\Users\user\AppData\Local\Programs\Teams\Teams.exe

                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                  Process:C:\Users\user\Desktop\cMqyGFCQHk.exe
                                                                                                                                                                                                                  File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                  Size (bytes):188819968
                                                                                                                                                                                                                  Entropy (8bit):6.7569707985463126
                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                  SSDEEP:1572864:wwl41lgY+w9QLv1JWYc6UeOtUUGQUT1jdu4BPPuuwT2GOqiB1sr7zjg7ob753oUV:kF4oD0QdG09P
                                                                                                                                                                                                                  MD5:102326801694C938E466C8D96E4200BD
                                                                                                                                                                                                                  SHA1:D2CC5A838F3E69EFE5CB38AE073D336F4E6F859A
                                                                                                                                                                                                                  SHA-256:376A7F107EB0CEB35E3F0DCF6212D2C3DD5EA100FE5A21B8233483644FEA3AE0
                                                                                                                                                                                                                  SHA-512:2EA4204051B9FEDB9BEBE3BE3232298C79ED28DD4000545BAD81FE5B35DB4AB429730E04A4AC3C647356E20777D8A31A16960D609F08D2161DFAF3D04FDDC5F3
                                                                                                                                                                                                                  Malicious:true
                                                                                                                                                                                                                  Antivirus:
                                                                                                                                                                                                                  • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                  Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d......g.........."......FH.........`IY........@.............................@............`..........................................d..k...0...h....`m.......#...H...........q..5..P.......................0...(....}H.@............................................text...*DH......FH................. ..`.rdata.......`H......LH.............@..@.data....H......L..................@....pdata....H...#...H.................@..@.gxfg....B...pl..D....-.............@..@.retplne......l......*...................rodata.......l......,.............. ..`.tls..........l......>..............@...CPADinfo8.....m......D..............@...LZMADEC.......m......F.............. ..`_RDATA.......0m......X..............@..@malloc_h.....@m......Z.............. ..`prot.........Pm......\..............@..@.rsrc........`m......^..............@..@.reloc...5....q..6....1.............@..B................

                                                                                                                                                                                                                  C:\Users\user\AppData\Local\Programs\Teams\chrome_100_percent.pak

                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                  Process:C:\Users\user\Desktop\cMqyGFCQHk.exe
                                                                                                                                                                                                                  File Type:data
                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                  Size (bytes):151599
                                                                                                                                                                                                                  Entropy (8bit):7.915992368779121
                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                  SSDEEP:3072:ez8JCGIdTwTPagr8o9RHi/T9P1L2o418Gb0+VRLf0ld0GY3cQ3ERVm2I:ez81IdT8agr8EC/T95K18Gb0OV8ld0Gq
                                                                                                                                                                                                                  MD5:83EC43F2AF9FC52025F3F807B185D424
                                                                                                                                                                                                                  SHA1:EA432F7571D89DD43A76D260CB5853CADA253AA0
                                                                                                                                                                                                                  SHA-256:A659EE9EB38636F85F5336587C578FB29740D3EFFAFF9B92852C8A210E92978C
                                                                                                                                                                                                                  SHA-512:6DDCA85215BF6F7F9B17C5D52BD7395702515BC2354A8CD8FA6C1CCD7355A23B17828853CEABEEF597B5BCA11750DC7C9F6EC3C45A33C2106F816FEC74963D86
                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                  Preview:..........<.............h.....i.\...j.....k.I...l.....n.....o.....p.:...q.4...r.o...s.?...t..!..u..%..v.@'..w..1..x..<..y.l?..z..C..{..G..|..I..}..J..~..M.....O.....R....|V.....Z.....]....N`.....a....3c....gd.....e....@g.....g.....m....~s....Fw....&{.....~..........*.....m................8..........._...........1....V.............w....e........F.........'....Z....k....5...,.....-.h........./.....0.!...1.....6.f...7.....8..!....$....&...../.....1.....5....3:....CE.....F....(O.....U....b[.....`....g....^i.....m.....q....V{....v~..............R...............X.....#.................................................|.....S..........W...........i..........2.....`...........S...........S.....(............................s...........y.....N.....".......................&.............................................Q"....-#.....#....$....v%....?&.....&....*(.... ).....*...........2....33....3.....3.....4....5....v6.....6.....7....f7....7.....7.....>.....A....sB

                                                                                                                                                                                                                  C:\Users\user\AppData\Local\Programs\Teams\chrome_200_percent.pak

                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                  Process:C:\Users\user\Desktop\cMqyGFCQHk.exe
                                                                                                                                                                                                                  File Type:data
                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                  Size (bytes):228644
                                                                                                                                                                                                                  Entropy (8bit):7.946488830213853
                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                  SSDEEP:6144:coDQYajN6svyA6nI86ur8EC/T9ugx5GMRejnbdZnVE6YoppO4:cVfjN6svyA6D4B79a6edhVELoXO4
                                                                                                                                                                                                                  MD5:DC48A33BD20BFC7CACFC925A84B015B6
                                                                                                                                                                                                                  SHA1:8DFEE88FD1DC77F89AD88C19146FE3AB45E43F3C
                                                                                                                                                                                                                  SHA-256:2C1B3E4B8A0CF837AE0A390FCA54F45D7D22418E040F1DFEA979622383ACCED6
                                                                                                                                                                                                                  SHA-512:1D54EB5D2BA06AF0BA8F6B491B0D43F178A48AC82CDF383BEB265E732DDFC06BCA9692003FDFCE56F7F00AF97F29ACF046C73B891B8C561610098F9626EAF05A
                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                  Preview:..........<.........&...h.....i.....j.....k.....l.....n.....o.|%..p..*..q..-..r.85..s..:..t..>..u.CG..v..K..w.._..x._t..y.{y..z....{.4...|....}.m...~...............................................h.............................5.................t...........-.................D............$.....-....K9.....@....FH...bL...9O...nT...)U...jV...UZ....]...s`...xc...f....j...n..,.\r..-..s....ku../..v..0..w..1.Dx..6..x..7.....8.Q............................F................S..........{...........^.....@...........!....%....&/....R2....:....>....RH....R.....V....|X....Sa.....i....k.....n.....r.....y.....{....%..........`.....7...........................................0.....I..........;.....l.....b.....B.....%.....S.....m..........L...........R..........V...........g.....)........................!.....'....-....u3.....4.....5.....6.....8....:9.....:.....<....=....`?....$L.....\....v\.....\....;].....]....._....._....K`....`.....a....]a....a.....g.....k....Rl

                                                                                                                                                                                                                  C:\Users\user\AppData\Local\Programs\Teams\d3dcompiler_47.dll

                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                  Process:C:\Users\user\Desktop\cMqyGFCQHk.exe
                                                                                                                                                                                                                  File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                  Size (bytes):4916728
                                                                                                                                                                                                                  Entropy (8bit):6.398031738914566
                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                  SSDEEP:49152:hCZnRO4XyM53Rkq4ypQqdoRpmruVNYvkaRwvdiD0N+YEzI4og/RfzHLeHTRhFRN1:oG2QCwmHjnog/pzHAo/Ayc
                                                                                                                                                                                                                  MD5:A7B7470C347F84365FFE1B2072B4F95C
                                                                                                                                                                                                                  SHA1:57A96F6FB326BA65B7F7016242132B3F9464C7A3
                                                                                                                                                                                                                  SHA-256:AF7B99BE1B8770C0E4D18E43B04E81D11BDEB667FA6B07ADE7A88F4C5676BF9A
                                                                                                                                                                                                                  SHA-512:83391A219631F750499FD9642D59EC80FB377C378997B302D10762E83325551BB97C1086B181FFF0521B1CA933E518EAB71A44A3578A23691F215EBB1DCE463D
                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                  Antivirus:
                                                                                                                                                                                                                  • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                  Joe Sandbox View:
                                                                                                                                                                                                                  • Filename: Soltix.exe, Detection: malicious, Browse
                                                                                                                                                                                                                  • Filename: Soltix.exe, Detection: malicious, Browse
                                                                                                                                                                                                                  • Filename: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, Detection: malicious, Browse
                                                                                                                                                                                                                  • Filename: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, Detection: malicious, Browse
                                                                                                                                                                                                                  • Filename: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, Detection: malicious, Browse
                                                                                                                                                                                                                  • Filename: Prismifyr_Installer_v2.1 Setup 1.0.0.exe, Detection: malicious, Browse
                                                                                                                                                                                                                  • Filename: svchost.exe, Detection: malicious, Browse
                                                                                                                                                                                                                  • Filename: JaborSetup.exe, Detection: malicious, Browse
                                                                                                                                                                                                                  • Filename: ArenaWarsSetup.exe, Detection: malicious, Browse
                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........|3..]...]...]..e\...]...\.5.]..e...]..wX...]..wY...]..e^...]..eX.y.]..eY...]..e]...]..eU./.]..e....]..e_...].Rich..].................PE..d.....Ne.........." ......8..........<).......................................K......JK...`A........................................`%G.x....(G.P.....J.@.....H.......J..%....J.....p.D.p....................S<.(...pR<.@............S<.(............................text.....8.......8................. ..`.rdata...F....8..P....8.............@..@.data...`....@G......@G.............@....pdata........H......@H.............@..@.rsrc...@.....J......@J.............@..@.reloc........J......PJ.............@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                  C:\Users\user\AppData\Local\Programs\Teams\ffmpeg.dll

                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                  Process:C:\Users\user\Desktop\cMqyGFCQHk.exe
                                                                                                                                                                                                                  File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                  Size (bytes):2929152
                                                                                                                                                                                                                  Entropy (8bit):6.70454100720416
                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                  SSDEEP:49152:ZBAnytEwrZu/3Q8rvnh2UGH6qfhtvRIdefZiC6Cry2:ZBFE6kfbrvnh21K+io
                                                                                                                                                                                                                  MD5:5A168CB3EA9D0E7400BAABF60F6AB933
                                                                                                                                                                                                                  SHA1:82A86CB7F42294AB4AD6669C19B92605D960B676
                                                                                                                                                                                                                  SHA-256:AF5F1BC9F6A73750FA0C7BF17439700CFB3AB23E1393F0C9899825417E319B54
                                                                                                                                                                                                                  SHA-512:7C1441ECD049543E38297A7B6929E9F3EB978422D0CE508FBE6350FFEBD297F947B8D9EC75BD2054142DCD8461EEF1BF110E040D0830DA977FDE8944BECE843D
                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                  Antivirus:
                                                                                                                                                                                                                  • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                  Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d......g.........." ......#...................................................:...........`A..........................................*.......*.(.............9..............:.<5....*.......................*.(.....$.@...........H.*.8............................text.....#.......#................. ..`.rdata........$.......#.............@..@.data.........+.."....+.............@....pdata.......9.......+.............@..@.gxfg....+...0:..,...J,.............@..@.retplne.....`:......v,..................tls.........p:......x,.............@..._RDATA........:......z,.............@..@.reloc..<5....:..6...|,.............@..B................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                  C:\Users\user\AppData\Local\Programs\Teams\icudtl.dat

                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                  Process:C:\Users\user\Desktop\cMqyGFCQHk.exe
                                                                                                                                                                                                                  File Type:data
                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                  Size (bytes):10468208
                                                                                                                                                                                                                  Entropy (8bit):6.265606239082294
                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                  SSDEEP:196608:+SPBhORiYAXHiXUxY/iJ53IWhlVjEeIu2Y6U:++wkpHiXUxY/iJ53IWhlVjEeIZU
                                                                                                                                                                                                                  MD5:FFD67C1E24CB35DC109A24024B1BA7EC
                                                                                                                                                                                                                  SHA1:99F545BC396878C7A53E98A79017D9531AF7C1F5
                                                                                                                                                                                                                  SHA-256:9AE98C06CBB0EA43C5CD6B5725310C008C65E46072421A1118CB88E1DE9A8B92
                                                                                                                                                                                                                  SHA-512:E1A865E685D2D3BACD0916D4238A79462519D887FEB273A251120BB6AF2B4481D025F3B21CE9A1A95A49371A0AA3ECF072175BA756974E831DBFDE1F0FEAEB79
                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                  Preview:...'........CmnD........ Copyright (C) 2016 and later: Unicode, Inc. and others. License & terms of use: http://www.unicode.org/copyright.html ......E.......E...(...E...)...F...).."F...1..5F..`1..EF...N..XF..PN..hF...N..xF.......F.......F.......F..@....F.......F......F..0....F.......G......$G......7G......JG......]G..@...pG.......G.......G..@....G.......G.......G..@....G.......G..p....H..`....H.......H..@...AH......TH..p...gH.....zH.......H..`....H.......H.......H..P....H.......H......H..`....I......%I..P...:I......RI.....bI..@...uI.......I.......I.......I..P....I.......I.......I..0....I.......J... ...J.. !..-J..@$..=J...$..PJ...$..qJ.......J...<...J....&..J....&..J.. .&..J....&..K..`.&..K....&.3K....&.JK..0.&.aK....'.xK....'..K....'..K...(..K....(..K...O)..K....)..L..0Q*.>L..`.*.gL..Pi+..L....+..L...i,..L....,..L..P}-..M..@.-.,M.. .-.EM....-.\M....-.uM....-..M...$...M..0%...M....0..M...j0..M..`.0..N..p.0.1N....0.AN....0.TN..@.0.iN....0..N..0.0..N....0..N....0..N....1..N....1..N..

                                                                                                                                                                                                                  C:\Users\user\AppData\Local\Programs\Teams\libEGL.dll

                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                  Process:C:\Users\user\Desktop\cMqyGFCQHk.exe
                                                                                                                                                                                                                  File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                  Size (bytes):493056
                                                                                                                                                                                                                  Entropy (8bit):6.3672588781107775
                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                  SSDEEP:6144:0PfRujpqWG9btH+M1wLPfj9iDcHetGsHUN0dxI2H6sNkD4Fvh2W:eAWt+MWLPfjkVGbN0dxI2H63D4Bh2
                                                                                                                                                                                                                  MD5:39CCF402A62F068A8C573B45EA96154D
                                                                                                                                                                                                                  SHA1:57CEB915EA6F88C7FCCA35339BF951659C0338AB
                                                                                                                                                                                                                  SHA-256:8649D77ACE8E5753B9A10E7AE3349AAFA9D8E3406BA9C8C36A59633A84B3C41B
                                                                                                                                                                                                                  SHA-512:C4F9225C54D413176CB3DD2B26D429493FD056C7C283BC7A1C52B4A2059DBB11380DAF5D847BE1FF29F058BA0EF44D4BF66A3D9E9A600000DC8F6D20DFB2ED03
                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                  Antivirus:
                                                                                                                                                                                                                  • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                  Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d......g.........." .....l................................................................`A.........................................l......h{..(.......x....P..l?..............<....d.......................c..(.......@...........p~...............................text....k.......l.................. ..`.rdata..lr.......t...p..............@..@.data....K....... ..................@....pdata..l?...P...@..................@..@.gxfg... &.......(...D..............@..@.retplne.............l...................tls....!............n..............@..._RDATA...............p..............@..@.rsrc...x............r..............@..@.reloc..<............x..............@..B........................................................................................................................................................................................................................

                                                                                                                                                                                                                  C:\Users\user\AppData\Local\Programs\Teams\libGLESv2.dll

                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                  Process:C:\Users\user\Desktop\cMqyGFCQHk.exe
                                                                                                                                                                                                                  File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                  Size (bytes):8418304
                                                                                                                                                                                                                  Entropy (8bit):6.508090684401189
                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                  SSDEEP:98304:Q7XpFwEPVsR+1HYJnahAB4tVsX43wYMg:QXVrAtsw
                                                                                                                                                                                                                  MD5:F055A130C79BD517BDB53B1F8A38BD3B
                                                                                                                                                                                                                  SHA1:9FBA0AD4BA973BB285B23CC125004BAF61A98B5A
                                                                                                                                                                                                                  SHA-256:45B53759392B81CE7D916B3F1CF02BE30289809BD31D09FC1524EF2609183B17
                                                                                                                                                                                                                  SHA-512:D9DCB217F268862C577CACF4E9F84C63E02B647113D484338A74EB0B24FADD6D87B4E7A551DD1EF692BB38E44562BFF848982ACB62840D4F49F91A7751320E34
                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                  Antivirus:
                                                                                                                                                                                                                  • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                  Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d......g.........." ......d...........N......................................`............`A........................................m.w.......x.d....p........}..H....................w.......................w.(.....d.@.............x.......w.@....................text.....d.......d................. ..`.rdata..D.....d.......d.............@..@.data.........y.......y.............@....pdata...H....}..J....}.............@..@.gxfg....-...........d..............@..@.retplne.....@...........................tls....B....P......................@..._RDATA.......`......................@..@.rsrc........p......................@..@.reloc..............................@..B........................................................................................................................................................................................................................

                                                                                                                                                                                                                  C:\Users\user\AppData\Local\Programs\Teams\resources.pak

                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                  Process:C:\Users\user\Desktop\cMqyGFCQHk.exe
                                                                                                                                                                                                                  File Type:data
                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                  Size (bytes):5755390
                                                                                                                                                                                                                  Entropy (8bit):7.996220000544904
                                                                                                                                                                                                                  Encrypted:true
                                                                                                                                                                                                                  SSDEEP:98304:JZ5ti6+nkrht455GGPeenn0mJSwLEpxIvMi8rwrGU3nAaqdkmYAzFKwR4:j7ilnkrP455GGHnhEXU8kr1Xqdf1FvG
                                                                                                                                                                                                                  MD5:6772B597BF68622D934F207570E771B1
                                                                                                                                                                                                                  SHA1:F2A80FBFA034CB1FA07DC9AA37BF9F5B2280FF13
                                                                                                                                                                                                                  SHA-256:268DE4D99AB7C4F4EE32C8E8CB2B058A2C8D0D839F468AE8E8C0605FEAA736EA
                                                                                                                                                                                                                  SHA-512:A2BE67DF09951C9EF9200DCCCBDFF13736921522191F0001DA539D5C7F26B5B26A6B810BE6963908F216768C98D21E52486C7E00538CC0730E8C78E78811B85B
                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                  Preview:............f..#..{.V...|.*1..~..4....OG....aI................V...........@..............................................D9....Dc....D.....D.....D.....D.....D,....D" ...D*$...D.$..HE.$..IE.(..JEx*..SE-/..TE.8..UE.G..VE.h..\E.q..]E.r..^E.s..`E*t..aEty..bE....cExo..dE.Z..eE.[...E.\...E.m...Eho...Exs...E.u...E.{...E.....E....E.....E.....E[....E....EV....E.....E.....E7....E.....E.....E2....E.....L9....L.....L.....L+....LP....L.....L(.../Lo...0L5...1L,)..2L.3...Q.D...Q.P...QdY...Q.\...Q._...Q.j...Q.k...Q.l...QAn...Q.....Q.....R.....R....ZdA&..[d"(..\d:=..]d.@..^dpA.._d3D..`d.G..adqI...d.T...d.Y...d._...d.m...d.p...dUu...d.v...d.x...d.y...d.|...d;....d....6eL...7e|...8e...9e5...:e....;e....<e....=e....>e#...?e....@eo...Ae....Be=...Cex....gp....ga0...g.2.....3.....6.....*....X+.....2.....2.....4.....9.....L....K...........a.....g.....9.....Y.................7... .>...<..L..=..M..>..S..?..X..@.cZ..B.]g..C..i..D..s..E..v..F..w..G.i...H.....I.....J.....K.]...L.....M.....N.S...O._...P.L...Q...

                                                                                                                                                                                                                  C:\Users\user\AppData\Local\Programs\Teams\snapshot_blob.bin

                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                  Process:C:\Users\user\Desktop\cMqyGFCQHk.exe
                                                                                                                                                                                                                  File Type:data
                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                  Size (bytes):316538
                                                                                                                                                                                                                  Entropy (8bit):4.177181507694743
                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                  SSDEEP:3072:p+JfFRciefJNlUMX2kIE1aOaVsS/3hYeFWYSITdJgClE+ceNTbM:pefPciePmMXh1aOCsy3hpFRlzVw
                                                                                                                                                                                                                  MD5:C8950B01F336B05609976546B1A007E6
                                                                                                                                                                                                                  SHA1:F04D0B0369007BBE6A7FE129B31B19DD1822F32F
                                                                                                                                                                                                                  SHA-256:9B3A75A713E41BC73F219858FCAC8E3031BA22732285ED3A64DC48074C725CC2
                                                                                                                                                                                                                  SHA-512:B7DB4277290E849A52AD5D31FF65AB5D2B75C2125D67EEEE02B09E4E7001AA46D10BF89429C65695C7560D1C45B898C20275EB9E36CD8B259707FFB8B298F103
                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                  Preview:..........(.._.13.0.245.16-electron.0..........................................`L..............l....K..}.a........a........a2.......aj.......ad.......a<....................r........2.............R..............r........2...(Jb...-Q.....@...^.M..Q.`.....(Jb...1U.....@...^..`.....H...IDa........Db............D`.....I.D`......]D....Da..........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa............L.....................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                  C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_2cvl0arq.dgy.psm1

                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                  Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                  File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                  Size (bytes):60
                                                                                                                                                                                                                  Entropy (8bit):4.038920595031593
                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                  SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                                                                                  MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                                                                  SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                                                                  SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                                                                  SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                  Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                                                                                                  C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_3ldohxpv.swz.ps1

                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                  Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                  File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                  Size (bytes):60
                                                                                                                                                                                                                  Entropy (8bit):4.038920595031593
                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                  SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                                                                                  MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                                                                  SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                                                                  SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                                                                  SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                  Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                                                                                                  C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_bqou54v3.qms.psm1

                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                  Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                  File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                  Size (bytes):60
                                                                                                                                                                                                                  Entropy (8bit):4.038920595031593
                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                  SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                                                                                  MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                                                                  SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                                                                  SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                                                                  SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                  Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                                                                                                  C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ppv1qouh.wuv.ps1

                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                  Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                  File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                  Size (bytes):60
                                                                                                                                                                                                                  Entropy (8bit):4.038920595031593
                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                  SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                                                                                  MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                                                                  SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                                                                  SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                                                                  SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                  Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                                                                                                  C:\Users\user\AppData\Local\Temp\nshFAEA.tmp\7z-out\LICENSE.electron.txt

                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                  Process:C:\Users\user\Desktop\cMqyGFCQHk.exe
                                                                                                                                                                                                                  File Type:ASCII text
                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                  Size (bytes):1096
                                                                                                                                                                                                                  Entropy (8bit):5.13006727705212
                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                  SSDEEP:24:36DiJHxRHuyPP3GtIHw1Gg9QH+sUW8Ok4F+d1o36qjFD:36DiJzfPvGt7ICQH+sfIte36AFD
                                                                                                                                                                                                                  MD5:4D42118D35941E0F664DDDBD83F633C5
                                                                                                                                                                                                                  SHA1:2B21EC5F20FE961D15F2B58EFB1368E66D202E5C
                                                                                                                                                                                                                  SHA-256:5154E165BD6C2CC0CFBCD8916498C7ABAB0497923BAFCD5CB07673FE8480087D
                                                                                                                                                                                                                  SHA-512:3FFBBA2E4CD689F362378F6B0F6060571F57E228D3755BDD308283BE6CBBEF8C2E84BEB5FCF73E0C3C81CD944D01EE3FCF141733C4D8B3B0162E543E0B9F3E63
                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                  Preview:Copyright (c) Electron contributors.Copyright (c) 2013-2020 GitHub Inc...Permission is hereby granted, free of charge, to any person obtaining.a copy of this software and associated documentation files (the."Software"), to deal in the Software without restriction, including.without limitation the rights to use, copy, modify, merge, publish,.distribute, sublicense, and/or sell copies of the Software, and to.permit persons to whom the Software is furnished to do so, subject to.the following conditions:..The above copyright notice and this permission notice shall be.included in all copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,.EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND.NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE.LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION.OF CONTRACT, TORT OR OTHERWISE, ARISIN

                                                                                                                                                                                                                  C:\Users\user\AppData\Local\Temp\nshFAEA.tmp\7z-out\LICENSES.chromium.html

                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                  Process:C:\Users\user\Desktop\cMqyGFCQHk.exe
                                                                                                                                                                                                                  File Type:HTML document, ASCII text
                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                  Size (bytes):9099045
                                                                                                                                                                                                                  Entropy (8bit):4.754770173605162
                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                  SSDEEP:24576:2o9dQ06p6j6j1WOwRiXjYmfy6k6mjK64jK6gjK6e6cjK6feGjl8PpE:BFOeGT
                                                                                                                                                                                                                  MD5:6FF57C0AECCDF44C39C95DEE9ECEA805
                                                                                                                                                                                                                  SHA1:C76669A1354067A1C3DDBC032E66C323286A8D43
                                                                                                                                                                                                                  SHA-256:0BA4C7B781E9F149195A23D3BE0F704945F858A581871A9FEDD353F12CE839CA
                                                                                                                                                                                                                  SHA-512:D6108E1D1D52AA3199FF051C7B951025DBF51C5CB18E8920304116DCEF567367ED682245900FDA3AD354C5D50AA5A3C4E6872570A839A3A55D3A9B7579BDFA24
                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                  Preview: Generated by licenses.py; do not edit. --><!doctype html>.<html>.<head>.<meta charset="utf-8">.<meta name="viewport" content="width=device-width">.<meta name="color-scheme" content="light dark">.<title>Credits</title>.<link rel="stylesheet" href="chrome://resources/css/text_defaults.css">.<link rel="stylesheet" href="chrome://credits/credits.css">.</head>.<body>.<span class="page-title">Credits</span>.<a id="print-link" href="#" hidden>Print</a>.<label class="show show-all" tabindex="0">.<input type="checkbox" hidden>.</label>.<div class="open-sourced">. Chromium software is made available as source code. <a href="https://source.chromium.org/chromium">here</a>..</div>..<div style="clear:both; overflow:auto;"> Chromium <3s the following projects -->.<div class="product">.<span class="title">2-dim General Purpose FFT (Fast Fourier/Cosine/Sine Transform) Package</span>.<span class="homepage"><a href="http://www.kurims.kyoto-u.ac.jp/~ooura/fft.html">homepage</a></span>.<labe

                                                                                                                                                                                                                  C:\Users\user\AppData\Local\Temp\nshFAEA.tmp\7z-out\Teams.exe

                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                  Process:C:\Users\user\Desktop\cMqyGFCQHk.exe
                                                                                                                                                                                                                  File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                  Size (bytes):188819968
                                                                                                                                                                                                                  Entropy (8bit):6.7569707985463126
                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                  SSDEEP:1572864:wwl41lgY+w9QLv1JWYc6UeOtUUGQUT1jdu4BPPuuwT2GOqiB1sr7zjg7ob753oUV:kF4oD0QdG09P
                                                                                                                                                                                                                  MD5:102326801694C938E466C8D96E4200BD
                                                                                                                                                                                                                  SHA1:D2CC5A838F3E69EFE5CB38AE073D336F4E6F859A
                                                                                                                                                                                                                  SHA-256:376A7F107EB0CEB35E3F0DCF6212D2C3DD5EA100FE5A21B8233483644FEA3AE0
                                                                                                                                                                                                                  SHA-512:2EA4204051B9FEDB9BEBE3BE3232298C79ED28DD4000545BAD81FE5B35DB4AB429730E04A4AC3C647356E20777D8A31A16960D609F08D2161DFAF3D04FDDC5F3
                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                  Antivirus:
                                                                                                                                                                                                                  • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                  Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d......g.........."......FH.........`IY........@.............................@............`..........................................d..k...0...h....`m.......#...H...........q..5..P.......................0...(....}H.@............................................text...*DH......FH................. ..`.rdata.......`H......LH.............@..@.data....H......L..................@....pdata....H...#...H.................@..@.gxfg....B...pl..D....-.............@..@.retplne......l......*...................rodata.......l......,.............. ..`.tls..........l......>..............@...CPADinfo8.....m......D..............@...LZMADEC.......m......F.............. ..`_RDATA.......0m......X..............@..@malloc_h.....@m......Z.............. ..`prot.........Pm......\..............@..@.rsrc........`m......^..............@..@.reloc...5....q..6....1.............@..B................

                                                                                                                                                                                                                  C:\Users\user\AppData\Local\Temp\nshFAEA.tmp\7z-out\chrome_100_percent.pak

                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                  Process:C:\Users\user\Desktop\cMqyGFCQHk.exe
                                                                                                                                                                                                                  File Type:data
                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                  Size (bytes):151599
                                                                                                                                                                                                                  Entropy (8bit):7.915992368779121
                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                  SSDEEP:3072:ez8JCGIdTwTPagr8o9RHi/T9P1L2o418Gb0+VRLf0ld0GY3cQ3ERVm2I:ez81IdT8agr8EC/T95K18Gb0OV8ld0Gq
                                                                                                                                                                                                                  MD5:83EC43F2AF9FC52025F3F807B185D424
                                                                                                                                                                                                                  SHA1:EA432F7571D89DD43A76D260CB5853CADA253AA0
                                                                                                                                                                                                                  SHA-256:A659EE9EB38636F85F5336587C578FB29740D3EFFAFF9B92852C8A210E92978C
                                                                                                                                                                                                                  SHA-512:6DDCA85215BF6F7F9B17C5D52BD7395702515BC2354A8CD8FA6C1CCD7355A23B17828853CEABEEF597B5BCA11750DC7C9F6EC3C45A33C2106F816FEC74963D86
                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                  Preview:..........<.............h.....i.\...j.....k.I...l.....n.....o.....p.:...q.4...r.o...s.?...t..!..u..%..v.@'..w..1..x..<..y.l?..z..C..{..G..|..I..}..J..~..M.....O.....R....|V.....Z.....]....N`.....a....3c....gd.....e....@g.....g.....m....~s....Fw....&{.....~..........*.....m................8..........._...........1....V.............w....e........F.........'....Z....k....5...,.....-.h........./.....0.!...1.....6.f...7.....8..!....$....&...../.....1.....5....3:....CE.....F....(O.....U....b[.....`....g....^i.....m.....q....V{....v~..............R...............X.....#.................................................|.....S..........W...........i..........2.....`...........S...........S.....(............................s...........y.....N.....".......................&.............................................Q"....-#.....#....$....v%....?&.....&....*(.... ).....*...........2....33....3.....3.....4....5....v6.....6.....7....f7....7.....7.....>.....A....sB

                                                                                                                                                                                                                  C:\Users\user\AppData\Local\Temp\nshFAEA.tmp\7z-out\chrome_200_percent.pak

                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                  Process:C:\Users\user\Desktop\cMqyGFCQHk.exe
                                                                                                                                                                                                                  File Type:data
                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                  Size (bytes):228644
                                                                                                                                                                                                                  Entropy (8bit):7.946488830213853
                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                  SSDEEP:6144:coDQYajN6svyA6nI86ur8EC/T9ugx5GMRejnbdZnVE6YoppO4:cVfjN6svyA6D4B79a6edhVELoXO4
                                                                                                                                                                                                                  MD5:DC48A33BD20BFC7CACFC925A84B015B6
                                                                                                                                                                                                                  SHA1:8DFEE88FD1DC77F89AD88C19146FE3AB45E43F3C
                                                                                                                                                                                                                  SHA-256:2C1B3E4B8A0CF837AE0A390FCA54F45D7D22418E040F1DFEA979622383ACCED6
                                                                                                                                                                                                                  SHA-512:1D54EB5D2BA06AF0BA8F6B491B0D43F178A48AC82CDF383BEB265E732DDFC06BCA9692003FDFCE56F7F00AF97F29ACF046C73B891B8C561610098F9626EAF05A
                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                  Preview:..........<.........&...h.....i.....j.....k.....l.....n.....o.|%..p..*..q..-..r.85..s..:..t..>..u.CG..v..K..w.._..x._t..y.{y..z....{.4...|....}.m...~...............................................h.............................5.................t...........-.................D............$.....-....K9.....@....FH...bL...9O...nT...)U...jV...UZ....]...s`...xc...f....j...n..,.\r..-..s....ku../..v..0..w..1.Dx..6..x..7.....8.Q............................F................S..........{...........^.....@...........!....%....&/....R2....:....>....RH....R.....V....|X....Sa.....i....k.....n.....r.....y.....{....%..........`.....7...........................................0.....I..........;.....l.....b.....B.....%.....S.....m..........L...........R..........V...........g.....)........................!.....'....-....u3.....4.....5.....6.....8....:9.....:.....<....=....`?....$L.....\....v\.....\....;].....]....._....._....K`....`.....a....]a....a.....g.....k....Rl

                                                                                                                                                                                                                  C:\Users\user\AppData\Local\Temp\nshFAEA.tmp\7z-out\d3dcompiler_47.dll

                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                  Process:C:\Users\user\Desktop\cMqyGFCQHk.exe
                                                                                                                                                                                                                  File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                  Size (bytes):4916728
                                                                                                                                                                                                                  Entropy (8bit):6.398031738914566
                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                  SSDEEP:49152:hCZnRO4XyM53Rkq4ypQqdoRpmruVNYvkaRwvdiD0N+YEzI4og/RfzHLeHTRhFRN1:oG2QCwmHjnog/pzHAo/Ayc
                                                                                                                                                                                                                  MD5:A7B7470C347F84365FFE1B2072B4F95C
                                                                                                                                                                                                                  SHA1:57A96F6FB326BA65B7F7016242132B3F9464C7A3
                                                                                                                                                                                                                  SHA-256:AF7B99BE1B8770C0E4D18E43B04E81D11BDEB667FA6B07ADE7A88F4C5676BF9A
                                                                                                                                                                                                                  SHA-512:83391A219631F750499FD9642D59EC80FB377C378997B302D10762E83325551BB97C1086B181FFF0521B1CA933E518EAB71A44A3578A23691F215EBB1DCE463D
                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                  Antivirus:
                                                                                                                                                                                                                  • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........|3..]...]...]..e\...]...\.5.]..e...]..wX...]..wY...]..e^...]..eX.y.]..eY...]..e]...]..eU./.]..e....]..e_...].Rich..].................PE..d.....Ne.........." ......8..........<).......................................K......JK...`A........................................`%G.x....(G.P.....J.@.....H.......J..%....J.....p.D.p....................S<.(...pR<.@............S<.(............................text.....8.......8................. ..`.rdata...F....8..P....8.............@..@.data...`....@G......@G.............@....pdata........H......@H.............@..@.rsrc...@.....J......@J.............@..@.reloc........J......PJ.............@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                  C:\Users\user\AppData\Local\Temp\nshFAEA.tmp\7z-out\ffmpeg.dll

                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                  Process:C:\Users\user\Desktop\cMqyGFCQHk.exe
                                                                                                                                                                                                                  File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                  Size (bytes):2929152
                                                                                                                                                                                                                  Entropy (8bit):6.70454100720416
                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                  SSDEEP:49152:ZBAnytEwrZu/3Q8rvnh2UGH6qfhtvRIdefZiC6Cry2:ZBFE6kfbrvnh21K+io
                                                                                                                                                                                                                  MD5:5A168CB3EA9D0E7400BAABF60F6AB933
                                                                                                                                                                                                                  SHA1:82A86CB7F42294AB4AD6669C19B92605D960B676
                                                                                                                                                                                                                  SHA-256:AF5F1BC9F6A73750FA0C7BF17439700CFB3AB23E1393F0C9899825417E319B54
                                                                                                                                                                                                                  SHA-512:7C1441ECD049543E38297A7B6929E9F3EB978422D0CE508FBE6350FFEBD297F947B8D9EC75BD2054142DCD8461EEF1BF110E040D0830DA977FDE8944BECE843D
                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                  Antivirus:
                                                                                                                                                                                                                  • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                  Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d......g.........." ......#...................................................:...........`A..........................................*.......*.(.............9..............:.<5....*.......................*.(.....$.@...........H.*.8............................text.....#.......#................. ..`.rdata........$.......#.............@..@.data.........+.."....+.............@....pdata.......9.......+.............@..@.gxfg....+...0:..,...J,.............@..@.retplne.....`:......v,..................tls.........p:......x,.............@..._RDATA........:......z,.............@..@.reloc..<5....:..6...|,.............@..B................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                  C:\Users\user\AppData\Local\Temp\nshFAEA.tmp\7z-out\icudtl.dat

                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                  Process:C:\Users\user\Desktop\cMqyGFCQHk.exe
                                                                                                                                                                                                                  File Type:data
                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                  Size (bytes):10468208
                                                                                                                                                                                                                  Entropy (8bit):6.265606239082294
                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                  SSDEEP:196608:+SPBhORiYAXHiXUxY/iJ53IWhlVjEeIu2Y6U:++wkpHiXUxY/iJ53IWhlVjEeIZU
                                                                                                                                                                                                                  MD5:FFD67C1E24CB35DC109A24024B1BA7EC
                                                                                                                                                                                                                  SHA1:99F545BC396878C7A53E98A79017D9531AF7C1F5
                                                                                                                                                                                                                  SHA-256:9AE98C06CBB0EA43C5CD6B5725310C008C65E46072421A1118CB88E1DE9A8B92
                                                                                                                                                                                                                  SHA-512:E1A865E685D2D3BACD0916D4238A79462519D887FEB273A251120BB6AF2B4481D025F3B21CE9A1A95A49371A0AA3ECF072175BA756974E831DBFDE1F0FEAEB79
                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                  Preview:...'........CmnD........ Copyright (C) 2016 and later: Unicode, Inc. and others. License & terms of use: http://www.unicode.org/copyright.html ......E.......E...(...E...)...F...).."F...1..5F..`1..EF...N..XF..PN..hF...N..xF.......F.......F.......F..@....F.......F......F..0....F.......G......$G......7G......JG......]G..@...pG.......G.......G..@....G.......G.......G..@....G.......G..p....H..`....H.......H..@...AH......TH..p...gH.....zH.......H..`....H.......H.......H..P....H.......H......H..`....I......%I..P...:I......RI.....bI..@...uI.......I.......I.......I..P....I.......I.......I..0....I.......J... ...J.. !..-J..@$..=J...$..PJ...$..qJ.......J...<...J....&..J....&..J.. .&..J....&..K..`.&..K....&.3K....&.JK..0.&.aK....'.xK....'..K....'..K...(..K....(..K...O)..K....)..L..0Q*.>L..`.*.gL..Pi+..L....+..L...i,..L....,..L..P}-..M..@.-.,M.. .-.EM....-.\M....-.uM....-..M...$...M..0%...M....0..M...j0..M..`.0..N..p.0.1N....0.AN....0.TN..@.0.iN....0..N..0.0..N....0..N....0..N....1..N....1..N..

                                                                                                                                                                                                                  C:\Users\user\AppData\Local\Temp\nshFAEA.tmp\7z-out\libEGL.dll

                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                  Process:C:\Users\user\Desktop\cMqyGFCQHk.exe
                                                                                                                                                                                                                  File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                  Size (bytes):493056
                                                                                                                                                                                                                  Entropy (8bit):6.3672588781107775
                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                  SSDEEP:6144:0PfRujpqWG9btH+M1wLPfj9iDcHetGsHUN0dxI2H6sNkD4Fvh2W:eAWt+MWLPfjkVGbN0dxI2H63D4Bh2
                                                                                                                                                                                                                  MD5:39CCF402A62F068A8C573B45EA96154D
                                                                                                                                                                                                                  SHA1:57CEB915EA6F88C7FCCA35339BF951659C0338AB
                                                                                                                                                                                                                  SHA-256:8649D77ACE8E5753B9A10E7AE3349AAFA9D8E3406BA9C8C36A59633A84B3C41B
                                                                                                                                                                                                                  SHA-512:C4F9225C54D413176CB3DD2B26D429493FD056C7C283BC7A1C52B4A2059DBB11380DAF5D847BE1FF29F058BA0EF44D4BF66A3D9E9A600000DC8F6D20DFB2ED03
                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                  Antivirus:
                                                                                                                                                                                                                  • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                  Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d......g.........." .....l................................................................`A.........................................l......h{..(.......x....P..l?..............<....d.......................c..(.......@...........p~...............................text....k.......l.................. ..`.rdata..lr.......t...p..............@..@.data....K....... ..................@....pdata..l?...P...@..................@..@.gxfg... &.......(...D..............@..@.retplne.............l...................tls....!............n..............@..._RDATA...............p..............@..@.rsrc...x............r..............@..@.reloc..<............x..............@..B........................................................................................................................................................................................................................

                                                                                                                                                                                                                  C:\Users\user\AppData\Local\Temp\nshFAEA.tmp\7z-out\libGLESv2.dll

                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                  Process:C:\Users\user\Desktop\cMqyGFCQHk.exe
                                                                                                                                                                                                                  File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                  Size (bytes):8418304
                                                                                                                                                                                                                  Entropy (8bit):6.508090684401189
                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                  SSDEEP:98304:Q7XpFwEPVsR+1HYJnahAB4tVsX43wYMg:QXVrAtsw
                                                                                                                                                                                                                  MD5:F055A130C79BD517BDB53B1F8A38BD3B
                                                                                                                                                                                                                  SHA1:9FBA0AD4BA973BB285B23CC125004BAF61A98B5A
                                                                                                                                                                                                                  SHA-256:45B53759392B81CE7D916B3F1CF02BE30289809BD31D09FC1524EF2609183B17
                                                                                                                                                                                                                  SHA-512:D9DCB217F268862C577CACF4E9F84C63E02B647113D484338A74EB0B24FADD6D87B4E7A551DD1EF692BB38E44562BFF848982ACB62840D4F49F91A7751320E34
                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                  Antivirus:
                                                                                                                                                                                                                  • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                  Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d......g.........." ......d...........N......................................`............`A........................................m.w.......x.d....p........}..H....................w.......................w.(.....d.@.............x.......w.@....................text.....d.......d................. ..`.rdata..D.....d.......d.............@..@.data.........y.......y.............@....pdata...H....}..J....}.............@..@.gxfg....-...........d..............@..@.retplne.....@...........................tls....B....P......................@..._RDATA.......`......................@..@.rsrc........p......................@..@.reloc..............................@..B........................................................................................................................................................................................................................

                                                                                                                                                                                                                  C:\Users\user\AppData\Local\Temp\nshFAEA.tmp\7z-out\locales\af.pak

                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                  Process:C:\Users\user\Desktop\cMqyGFCQHk.exe
                                                                                                                                                                                                                  File Type:data
                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                  Size (bytes):533447
                                                                                                                                                                                                                  Entropy (8bit):5.412080848029905
                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                  SSDEEP:12288:WEGL+ocurcdy6VGycsaja+H2Jyngae5Ig1eo0vMIlgL2pQ+FXZG2vt2pslFd5/51:W1+ozrc86VZBaja+H2Jyngae5Ig1eo0N
                                                                                                                                                                                                                  MD5:D9BEC09B6C523DC3BCA9A81264B1BEED
                                                                                                                                                                                                                  SHA1:EA4AE9DFF554C59994632F85AF25B36C049FB5B2
                                                                                                                                                                                                                  SHA-256:0B5A45DE223CE8522CC296AF1E93477540EAA74867428307CC3A5CD21921B022
                                                                                                                                                                                                                  SHA-512:6E7677F86F73EDFFB5D6162CA19BB7464465F0F485CE2971FB20AD3F57D9FAC56B7A21D378701F80E85FB185C3AF6A238F8C8707F5874BFFFFD79D881A54DD6E
                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                  Preview:.........(..e.....h.....i.....j.....k.)...l.4...n.<...o.A...p.N...q.T...r.`...s.....t.....v.....w.....y.....z.\...|.....}.........................................................................#.....2.....C.....V...........A.......................c.........................................M.......................F.......................!.....o.......................c.................$.....y.................0.......................,.......................7 ..... ..... ..... ....h!.....!....."....1"....."....."....."....."....E#.....#.....#.....#.....$....@$...._$....h$.....$.....%....L%....[%.....%.....&....B&....R&.....&.....&.....'.....'....n'.....'.....'.....'....7(.....(.....(.....(....1).....).....).....)....Q*.....*.....*.....*....1+....s+.....+.....+.....,....U,....z,.....,.....-....]-.....-.....-....*.....h.......................I/....u/...../...../....A0....|0.....0....#1.....1.....1.....2....}2.....2.....3....=3.....3.....4....54....H4.....4.....4.....4.....5....e5.....5.....5

                                                                                                                                                                                                                  C:\Users\user\AppData\Local\Temp\nshFAEA.tmp\7z-out\locales\am.pak

                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                  Process:C:\Users\user\Desktop\cMqyGFCQHk.exe
                                                                                                                                                                                                                  File Type:data
                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                  Size (bytes):861015
                                                                                                                                                                                                                  Entropy (8bit):4.906916579483596
                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                  SSDEEP:24576:HzD984ToH3hTCNRysrxQH9hjN3Rpzvh51muMXqVFq+XG/6WxLP5A:qn5N
                                                                                                                                                                                                                  MD5:E3933DE22DC7FB98215B083D8A379F40
                                                                                                                                                                                                                  SHA1:68DDBD9BCC931F0D4A172FA65AF35B823C7C9E37
                                                                                                                                                                                                                  SHA-256:EAA747075E5A62BE8B7DF5908E167CCC5314C9C6A8B890059D00284A3C496FEF
                                                                                                                                                                                                                  SHA-512:7BEB80FA029F41CB21536B15C604E2AE9DFC20B4A3EC4F5CC04E2B105D4B2C251830624957197084761F9686F95D332E25D4F6178509AD58257AF90D96A9E7D5
                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                  Preview:.........(..e.....h.....i.%...j.1...k.@...l.K...n.S...o.X...p.e...q.k...r.w...s.....t.....v.....w.....y.E...z.s...|.....}.................................................&.....'.....(.....-.....I....._.......................`...................................6.................S...........E...........P.................x.................S ..... .....!.....!.....!....P".....".....".....#....^$.....$.....$.....%.....&....c&.....&.....'.....'.....(....A(.....(....{).....).....).....*.....+.....,....H,.....,.....-....C-....v-.....-....N................../....w/...../...../....u0.....1....y1.....1....@2.....2....03....F3.....3....c4.....4.....4...._5.....5....16....P6.....6....T7.....7.....7....`8.....9.....9.....9....0:.....:.....:.....;.....;.....;....6<....^<.....<....c=.....=.....=....{>.....>....b?.....?....*@.....@.....@.....@.....A.....B....RB....qB....,C.....C.....D....7D.....E.....E....TF....nF....9G.....G....NH.....H....LI.....I....`J.....J.....J....FK....lK.....K....8L.....L....6M

                                                                                                                                                                                                                  C:\Users\user\AppData\Local\Temp\nshFAEA.tmp\7z-out\locales\ar.pak

                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                  Process:C:\Users\user\Desktop\cMqyGFCQHk.exe
                                                                                                                                                                                                                  File Type:data
                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                  Size (bytes):943328
                                                                                                                                                                                                                  Entropy (8bit):4.930661249056055
                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                  SSDEEP:12288:NYI8HRnwBUC/+/RYfESugvPUB6m7kOCSn5KNp5QpnSKU/:SNHRnh5aQM
                                                                                                                                                                                                                  MD5:AC865FF462F341B4317C3D16EEB40460
                                                                                                                                                                                                                  SHA1:1E971D97F09884B23595F17534227EA43CF99090
                                                                                                                                                                                                                  SHA-256:0557BC17EB1D134BD52F203836551B55579114708E2DF51F653972951567513D
                                                                                                                                                                                                                  SHA-512:A935B91A2C053303E941866CFC151F28053FAF364AEECE98D61FCD68FEF6C6F1D3B73DE01CD602C8A4A081CCE452D1CE87F8166BA3C0E8B81E91D932F84737F2
                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                  Preview:........j(..e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.&...t.=...v.r...w.....y.....z.....|.....}.K.....t.....y.......................................................................L.....@.....#....................... .....|...........H...........m...........?...........L.....}.............................k............ ....) ..... ....a!.....!.....!....."....\#.....#.....#.....$.....%.... &....Q&.....&.....'.....'.....(.....(....l).....).....).....+.....+.....,.....,....p-.....-..........Y...........B/....u/...../.....0.....0.....0.....0.....1....Z2.....2.....2....h3.....3....,4....=4.....4....w5.....5.....5....q6.....6....57....L7.....7....W8.....8.....8....F9.....9....H:....e:.....:....d;.....;.....;....K<.....<.....<.....=....L>.....>.....>....U?.....?.....@....a@.....@....9A....\A....yA.....B.....B.....B.....C.....C.....C....KD....dD....lE....MF.....G.....G.....G....mH.....H.....H.....I.....J....EJ....\J.....J....%K....KK...._K.....L.....L....&M....HM.....M

                                                                                                                                                                                                                  C:\Users\user\AppData\Local\Temp\nshFAEA.tmp\7z-out\locales\bg.pak

                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                  Process:C:\Users\user\Desktop\cMqyGFCQHk.exe
                                                                                                                                                                                                                  File Type:data
                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                  Size (bytes):982837
                                                                                                                                                                                                                  Entropy (8bit):4.669923863173967
                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                  SSDEEP:24576:MhQgWoOYLYyzQkECvUPVbKDks373ZAW3AAK1mVDLpv74umpjd2SI5IxuFsoGQXxQ:VgWoOYLYfYUPVbKDks373ZN3ApmVDLpw
                                                                                                                                                                                                                  MD5:7C37C8C9B4215089B6C16D22838D256B
                                                                                                                                                                                                                  SHA1:8F2AFDC21353685353A0562452F4A79180E58829
                                                                                                                                                                                                                  SHA-256:2EBD582DFAA3139CD6A03E9892A94A3D9BB6936E0B04085B8F2D27E1DEC0BC8A
                                                                                                                                                                                                                  SHA-512:BEADD70E9D706576BFB6725617385F776E9F68C84D116B01187354D377E2C860899DA34F8C5A054C4BDE41A57E9AAC56445F6AC0B8DA8C75A424641A86FDD718
                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                  Preview:.........(..e.....h.....i."...j.....k.=...l.H...n.P...o.U...p.b...q.h...r.t...s.....t.....v.....w.....y.B...z.p...|.....}.................................................#.....$.....%.....*.....L.....e.............................$.....U.................9.....c...........p...........Z.....P.......................r ..... ....F!....l!.....".....".....".....#.....#.....$.....%....b%....^&.... '.....'.....'.....(.....)...."*....X*.... +.....+....5,...._,....K-......................./.....0....N1.....1....C2.....2.....3....)3.....3....\4.....4.....4....z5.....6....J6....p6....'7.....7.....8....E8.....8....n9.....9.....9....l:.....:....0;....P;.....;....a<.....<.....<....n=.....=....J>....r>....m?....S@.....@....-A.....A....^B.....B.....B...._C.....C.....D....gD....CE.....E....^F.....F.....G....3H.....H.....I.....I....NJ.....J.....J.....K....(L.....L.....L.....M....8N.....N.....N.....O.....P....XQ.....Q....}R....7S.....S.....S.....T....dU.....U.....U.....V.... W....kW.....W.....X....dY.....Y

                                                                                                                                                                                                                  C:\Users\user\AppData\Local\Temp\nshFAEA.tmp\7z-out\locales\bn.pak

                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                  Process:C:\Users\user\Desktop\cMqyGFCQHk.exe
                                                                                                                                                                                                                  File Type:data
                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                  Size (bytes):1267393
                                                                                                                                                                                                                  Entropy (8bit):4.284356072775859
                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                  SSDEEP:3072:LEcoGqGB2le1abaCb6Ew/0WySZIS+xd2f/MHDrYfHBpxspSPrCXqB+iBbHRI8T51:LjJfa56/0z5XpCOXqB+iBbD5YqNn
                                                                                                                                                                                                                  MD5:FC66ADF3DEAC72FD39105540DD2DAEFF
                                                                                                                                                                                                                  SHA1:A53B54EFCC1285A226D605116F87D12F69942482
                                                                                                                                                                                                                  SHA-256:EF50CFEBAF9E32EDEEC25D30197AC5899B3DB8A0676671F639D32BC48F3B3BD8
                                                                                                                                                                                                                  SHA-512:0B77DAA056451D01A8CFB3FF1ACC08D34E64E0A32BB119C8837AE3D6E3D5195311427C6101EFD7E7BC9104AA369832BB12AAB3D4080C00DC39EDC98B6C0B949E
                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                  Preview:.........(..e.....h.....i.....j.....k.....l.#...n.+...o.1...p.>...q.D...r.P...s.....t.....v.....w.....y.....z.L...|.s...}...............................................................................0.....U.....................................................?.......................Z.................. ..... ....(!.....!.....".....#....N#.....$.....$.....%....+%....R&....0'.....'.....(.....).....)....^*.....*.....+....~,.....-....1-.....-.........../....E/....@0....*1.....1.....1.....3.....4.....4.....5.....5....k6.....6.....6.....7.....8....`8.....8.....9.....9.....9.....:.....:.....;.....;....:<.....<.....=.....=.... >.....>....{?.....?.....?.....@....9A.....A.....A....XB.....B....LC....rC.....D.....E....{F.....F.....G.....H.....I....QI.....I....sJ.....J.....J.....K....iL.....L.....M.....M.....N....^O.....O.....P....#Q....oQ.....Q.....R....5S.....S.....S.....T....{U....#V....\V.....W.....X.....Y.....Z....@[....B\.....\....L].....^.....^....W_....._....]`....$a.....a.....a.....b.....c

                                                                                                                                                                                                                  C:\Users\user\AppData\Local\Temp\nshFAEA.tmp\7z-out\locales\ca.pak

                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                  Process:C:\Users\user\Desktop\cMqyGFCQHk.exe
                                                                                                                                                                                                                  File Type:data
                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                  Size (bytes):598934
                                                                                                                                                                                                                  Entropy (8bit):5.408962543645936
                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                  SSDEEP:12288:gVHfWsqPdf9nwWF47D1MeCi24b3Fe5PFFuN3Mw2juwHzejm0t3l3kb7TenzL8wOs:gV/WRdlnPyToiL6YhgMNxgCh5cxSas
                                                                                                                                                                                                                  MD5:E1AC7F4C28177F68FAC3BE2375A9368C
                                                                                                                                                                                                                  SHA1:3D7738699087468A748F9B1189D2F7621187D03B
                                                                                                                                                                                                                  SHA-256:EFA1BA906F8ABCE91EBB9D6442B64E0D5AE7DAB78DDA8A49A6FED1A342C71B9B
                                                                                                                                                                                                                  SHA-512:AEE8CB28EB02E2FB2155C8D093CF678284E3571F46B913F743DE3C6D0215C18B80866FF446F46ADA160860ED9C18AE9A4209424E7E0F0BA97C78A3FE9815CA5A
                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                  Preview:.........(..e.....h.....i.....j.....k.!...l.,...n.4...o.9...p.F...q.L...r.X...s.....t.....v.....w.....y.&...z.T...|.{...}.........................................................................%.....>.....^.....|.......................7.................S.....l.............................m.......................v.......................k...................................2.....`...........R.................- ..... ..... ..... ....I!.....!.....!.....!....c".....".....#....,#.....#....L$.....$.....$....3%.....%.....%.....%.....&....i&.....&.....&.....&....N'....{'.....'.....'....\(.....(.....(.....)....b).....).....).....)....H*....s*.....*.....*.....+....I+....V+.....+.....,....A,....R,.....,....D-.....-.....-..........\................../....L/....o/...../.....0....S0....h0.....0....N1.....1.....1....+2....r2.....2.....2.....3....^3.....3.....3.....4....c4.....4.....4....b5.....5....\6....w6.....6....c7.....7.....7....I8.....8.....8.....8....@9.....9.....9.....9....9:.....:.....:.....:

                                                                                                                                                                                                                  C:\Users\user\AppData\Local\Temp\nshFAEA.tmp\7z-out\locales\cs.pak

                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                  Process:C:\Users\user\Desktop\cMqyGFCQHk.exe
                                                                                                                                                                                                                  File Type:data
                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                  Size (bytes):616994
                                                                                                                                                                                                                  Entropy (8bit):5.843791316218894
                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                  SSDEEP:6144:863oqX0hmR4QkWA9jN85ASh6mARAO52C+wH/NOKbJSBXR8QQ:VYPNB85AS0P52C+wH/NOeJS+
                                                                                                                                                                                                                  MD5:92E3FD1EB47767A0CB5F6E734DE4EEC1
                                                                                                                                                                                                                  SHA1:33053BFEAD1FA67160B6A3C417EC4559BFDCDCFB
                                                                                                                                                                                                                  SHA-256:D269E16FBD9B2AFE95B148ECE22B2AC803768FB53EE42E1FAD0181F9DEC84544
                                                                                                                                                                                                                  SHA-512:916D73D9B28B0600878418A06388C2ED61BFAF17807A16E1C157A30E5DA136C6B6F194E99D151C43B9AA35D101DE755CAA6DA69E1C8A50DD134F27A7F2ADC016
                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                  Preview:.........(..e.....h.....i.....j.....k.....l.....n.....o.....p.&...q.,...r.8...s.g...t.~...v.....w.....y.....z.4...|.[...}...........................................................................................4...........^.................<.......................i...........A.....Z...........?.....{.................U.......................D.....l.................T.................:.................+............ ....K ....c ..... ....6!....k!....{!.....!....k"....."....."....:#.....#.....#.....$....u$.....$.....$.....$....N%.....%.....%.....%..../&.....&.....&.....&.....'.....'.....'.....'....2(.....(.....(.....(....-).....).....).....)...."*.....*.....*.....*....:+.....+.....+.....+....f,.....,....)-....@-.....-.....-.....-..........Q.......................W/...../...../...../....]0.....0.....1....I1.....1.....1.....2.....2.....2.....3....13....F3.....3.... 4....a4....y4.....4....g5.....5.....5....E6.....6.....7....77.....7.....8....D8....Y8.....8.....9....49....H9.....9....":....\:

                                                                                                                                                                                                                  C:\Users\user\AppData\Local\Temp\nshFAEA.tmp\7z-out\locales\da.pak

                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                  Process:C:\Users\user\Desktop\cMqyGFCQHk.exe
                                                                                                                                                                                                                  File Type:data
                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                  Size (bytes):558889
                                                                                                                                                                                                                  Entropy (8bit):5.449151445338137
                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                  SSDEEP:6144:Gqv1aOSLABh3359zVmh5OsfZh1seDrwwlQJWJwgIobwmPaHL95bpkUdRi3jd4xFm:GqonsMfPrWb55bpfddm
                                                                                                                                                                                                                  MD5:43029018648D558F9BBF7A74C59EB281
                                                                                                                                                                                                                  SHA1:90C6618CCCB4DB85D7485AE8D809EC3AF4763E70
                                                                                                                                                                                                                  SHA-256:4BD88F6AB82842358987AAD384775B35198DD75C2CCE4CAE783208ED69296A7E
                                                                                                                                                                                                                  SHA-512:9E8EF9D4367AD01F2F4E7DD6F9884E463729EE5A0F678FD16A3CE093C21EFC1D78041D5C6E45037F37BFD732E4833744485B00ACFDA2313A1D1E947993129A3D
                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                  Preview:.........(..e.....h.....i.+...j.7...k.F...l.Q...n.Y...o.^...p.k...q.q...r.}...s.....t.....v.....w.$...y.K...z.y...|.....}...........................................%.....,.....-...........0.....>.....N.....b.....{...........`.................!.......................l...........A.....]...........-.....].....q........... .....G.....T.................2.....@.................8.....R...........>.....z.................w.................. ..... ..... ..... ....l!.....!....@"....Z"....."....s#.....#.....#....A$.....$.....$.....$....(%.....%.....%.....%.....&....Z&....~&.....&.....&....R'.....'.....'.....'....W(.....(.....(.....(....K)....v).....).....)....**....P*....Z*.....*.....+....@+....N+.....+....I,.....,.....,.....-...._-.....-.....-.....-....<.....Z.....r............/....6/....F/...../.....0....h0.....0.....0....W1....|1.....1.....1....b2.....2.....2.....3....T3.....3.....3.....4.....4.....4.....4....q5.....5.....6....N6.....6.....7....J7....\7.....7.....7.....8.....8.....8.....8.....9

                                                                                                                                                                                                                  C:\Users\user\AppData\Local\Temp\nshFAEA.tmp\7z-out\locales\de.pak

                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                  Process:C:\Users\user\Desktop\cMqyGFCQHk.exe
                                                                                                                                                                                                                  File Type:data
                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                  Size (bytes):596603
                                                                                                                                                                                                                  Entropy (8bit):5.5059525736264
                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                  SSDEEP:12288:55U5D5aDs3K7UpGg5aL9Xtt5fPMkUz1CTz:5eaDs3K7UpGg5aLRf53MtCTz
                                                                                                                                                                                                                  MD5:3A8DE004B3A610271E1D1913B6D4B53B
                                                                                                                                                                                                                  SHA1:236893C3F7B450E6AD8B4D54E1A62B2E635B42D6
                                                                                                                                                                                                                  SHA-256:43C060182C92CAF4AEBF8FD7B913DFE017BEEA71E796E862EBF8746575948364
                                                                                                                                                                                                                  SHA-512:B70F849CCF7DD9E72D71522591420E0BAA03FF74763B44563B0B3800BA3A88CB8B973FABB90BBB6653819947ECA47F70E347958E3C31AB226957F7313BC03554
                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                  Preview:........((C.e.....h.....i.'...j.3...k.B...l.M...n.U...o.Z...p.g...q.m...r.y...s.....t.....v.....w. ...y.G...z.u...|.....}...........................................!.....(.....).....*.....,.....=.....P.....b.....x.....2...........J....._...........b.................?...................................?.....W...........B.....p.................k.................:.............................'.....c............ ..... ..... ..... ....O!.....!....."....#"....."....O#.....#.....#....]$.....$....Q%....p%.....%....O&....q&.....&.....&....^'.....'.....'.....(....p(.....(.....(....1).....).....).....*.....*.....+....7+....G+.....+.....,....a,....r,.....,....W-.....-.....-............................j/.....0....W0....m0.....0....J1....l1.....1.....1....62....S2....f2.....2....93....b3....u3.....4.....4.....4.....4...._5.....5.....5.....5....q6.....6.....7.... 7.....7.....8....X8....n8.....8....|9.....9.....9....i:.....:....);....V;.....;....?<....l<.....<.....<....U=....~=.....=.....>.....>.....>

                                                                                                                                                                                                                  C:\Users\user\AppData\Local\Temp\nshFAEA.tmp\7z-out\locales\el.pak

                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                  Process:C:\Users\user\Desktop\cMqyGFCQHk.exe
                                                                                                                                                                                                                  File Type:data
                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                  Size (bytes):1076241
                                                                                                                                                                                                                  Entropy (8bit):4.759988949622547
                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                  SSDEEP:24576:yvHcaFbu4FDYX9QCMDhWJXDsS7miHk3D2NpYRDojvmXgVT8y2IWYNQKlCt2rDQur:aHcaFbu4FDYX9QCMDhWJXDsS7miHcD2r
                                                                                                                                                                                                                  MD5:58D6EAF71B9B73F5F7F057C73D0D92EC
                                                                                                                                                                                                                  SHA1:16E0587753E7D2834F4CBB24FED45E7BD2F8F2F4
                                                                                                                                                                                                                  SHA-256:8474879DE21C414D34C44CF0A8C91356A66DBD647308A4F994BE25BD1F93A89F
                                                                                                                                                                                                                  SHA-512:AB24C9655BD68E4A64E257914A35DC84B5F791C58B396AE004BF5DA61DF19C02EF9CA572B8E63F15BAF3694AE1E540ADF74586F10D28D7EF90EDEEC982BCF28D
                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                  Preview:.........(..e.....h.....i.....j.....k.....l.(...n.0...o.5...p.B...q.H...r.T...s.....t.....v.....w.....y."...z.P...|.w...}...............................................................................S...........................................................T.....\.....0.................1...........F ..... ....C!.....!....)"....J"....."....~#.....#.....#.....$.....%.....%.....&.....'.....(.....(.....(.....)....t*.....*.....+.....+.....,....'-....R-....C............/...../.....0.....1.....2.....2....~3..../4....{4.....4....R5.....6....H6....m6.....7.....7.....8....<8.....9.....9....]:.....:....Q;.....<.....<.....<....y=....O>.....>.....>.....?....Y@.....@.....@.....A....QB.....B.....B.....C.....D....wE.....E....|F....DG.....G.....G....}H.....I....<I....XI.....J.....J.....K....0K.....L.....L....YM.....M....VN.....O....<O....cO.....P.....P....NQ.....Q....kR.....S.....S.....S.....T.....V.....V.....W.....X.....X....dY.....Y.....Z.....[....7\....h\....#].....]....W^....y^....._....z`.....`

                                                                                                                                                                                                                  C:\Users\user\AppData\Local\Temp\nshFAEA.tmp\7z-out\locales\en-GB.pak

                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                  Process:C:\Users\user\Desktop\cMqyGFCQHk.exe
                                                                                                                                                                                                                  File Type:data
                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                  Size (bytes):485863
                                                                                                                                                                                                                  Entropy (8bit):5.521699894815275
                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                  SSDEEP:6144:Ll+Npdwk8sj7ahcbKdFk+ufMP9ezQSKrfaYdrcLlY5IPxZBcvRJ+G:Ll++143fMuQSK3Z5MxLG
                                                                                                                                                                                                                  MD5:985558DE03BF486AEC1DAADD39CB508D
                                                                                                                                                                                                                  SHA1:B693DDEF983E8AF212936202DDCA92D908378404
                                                                                                                                                                                                                  SHA-256:1956D448A4D333638F3601D0DA976710CBE0A795504EB694BA18311FE586D195
                                                                                                                                                                                                                  SHA-512:13D1C82B797AD4FF25A94A996F9FB52B530643A0E735F96E32B9E0698962770148D95DB7BEB91343D781FB84378A3E334AC0C1C913D8DBAE20F425BF0DC364D3
                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                  Preview:.........)d.e.....h.....i.....j.....k.....l.....n.....o.....p."...q.(...r.4...s.c...t.z...v.....w.....y.....z.0...|.W...}...........................................................................................'.................E.....Y.......................>.................:.....P.................$.....9.............................K.............................Y.....~.................L.......................:.....k.....y.................;.....K.................. ..... ..... ..... ....!!....5!....t!.....!.....!.....!....."....N"....m"....w".....".....".....#....##....}#.....#.....#.....$....^$.....$.....$.....$....)%....n%.....%.....%.....%.....&....V&....a&.....&.....&.....'....#'.....'.....'.....(.....(....|(.....(.....(.....(....>)....z).....).....).....)....>*...._*....n*.....*.....+....G+....m+.....+.....+.....,.....,....q,.....,.....,.....,....`-.....-.....-.....-....[............/...../...../...../.....0....-0.....0.....0.....0.....1....Q1.....1.....1.....1.... 2....m2.....2

                                                                                                                                                                                                                  C:\Users\user\AppData\Local\Temp\nshFAEA.tmp\7z-out\locales\en-US.pak

                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                  Process:C:\Users\user\Desktop\cMqyGFCQHk.exe
                                                                                                                                                                                                                  File Type:data
                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                  Size (bytes):490357
                                                                                                                                                                                                                  Entropy (8bit):5.513411409378336
                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                  SSDEEP:6144:1kdXRDCwszpReMP9e0QcD2faYjNCu454ZxDng/t/XFLwB:1sUwGeM1QcDq+5UxOLwB
                                                                                                                                                                                                                  MD5:752A3FEED3AB6C127767C8FABC9A40B6
                                                                                                                                                                                                                  SHA1:4AF9F9C19904D3BEF154B469858DC44B1E630A75
                                                                                                                                                                                                                  SHA-256:C6A6C5D7AB6119BBA712D6FE45FD385506D4D0DD8E4156CCA3925062F4502AC5
                                                                                                                                                                                                                  SHA-512:AE96D4F391E36F8F741671B72EBD4B1AB2D049B2A99B95737FB9F81743B9E414B46022B65194AF5616EB354056ADDF0E46EF090F56B7D945EF2CB5F4D100D64F
                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                  Preview:........O)..e.\...h.d...i.l...j.x...k.....l.....n.....o.....p.....q.....r.....s.....t.....v.9...w.e...y.....z.....|.....}.......;.....@.....H.....P.....X....._.....f.....m.....n.....o.....t.............................#.......................;.......................0.......................3.....~.......................S.....|.......................=.....J.............................z.......................l.......................H........................ ....^ ..... ..... .....!....^!.....!.....!.....!....*"....E"....T"....."....."....."....."....8#....u#.....#.....#.....#....J$....|$.....$.....$....&%....S%...._%.....%.....%.....&....!&....i&.....&.....&.....&....)'....n'.....'.....'.....(....](.....(.....(.....(....=)....`)....v).....).....).....*....1*.....*.....*.....*.....*....P+.....+.....+.....+....7,....n,.....,.....,.....,....7-....a-....q-.....-..........N.....f...........7/...../...../...../....J0.....0.....0.....0....@1....l1....{1.....1.....2...."2....22.....2.....2.....3

                                                                                                                                                                                                                  C:\Users\user\AppData\Local\Temp\nshFAEA.tmp\7z-out\locales\es-419.pak

                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                  Process:C:\Users\user\Desktop\cMqyGFCQHk.exe
                                                                                                                                                                                                                  File Type:data
                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                  Size (bytes):589663
                                                                                                                                                                                                                  Entropy (8bit):5.378608358697393
                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                  SSDEEP:6144:cv+c/pQ8eguGEy1mVpDYl7G8oZOZ5zazaQ+ax891:cP3RsJpuGS5za9+D1
                                                                                                                                                                                                                  MD5:85E9B056E3AC3F6A5B113ED9F460E202
                                                                                                                                                                                                                  SHA1:DCCEEF6EA85D71A85DD24D17EC65371DCE76F480
                                                                                                                                                                                                                  SHA-256:16FE83762ED578C49685868418325920A72CD457907BC4E5264F2C172D53B27B
                                                                                                                                                                                                                  SHA-512:E4DFDE9C1260DF1F77B7EC1797658F8CFEAAB98142A8D512ED3BFAC054933A4583F20091B97985B4BA9CF93F9FACA3E7B0986CB4A3EB12FE0BC04EE1C45D3E0F
                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                  Preview:.........(..e.....h.....i.....j.+...k.:...l.E...n.M...o.R...p._...q.e...r.q...s.....t.....v.....w.....y.?...z.m...|.....}................................................. .....!.....".....$.....6.....E.....Z.....q.......................$.................A.....Y...........i.................`.................2.............................r...................................H.....x...........n.................P ..... .....!.....!.....!.....!....'"....>"....."....*#....r#.....#....%$.....$.....$....$%....v%.....%.....%.....&....[&.....&.....&.....&....R'.....'.....'.....'....l(.....(.....)....0).....).....)....2*....>*.....*.....*.....+....&+....x+.....+.....+.....,....p,.....,.....-....'-.....-..........f.................A/....p/...../...../....C0....j0.....0....41....j1....z1.....2....o2.....2.....2...._3.....3.....3.....3....U4.....4.....4.....4....y5.....5.....6.....6.....6....C7.....7.....7....N8.....8.....9....;9.....9....!:....e:....y:.....:.....;....5;....H;.....;....9<.....<.....<

                                                                                                                                                                                                                  C:\Users\user\AppData\Local\Temp\nshFAEA.tmp\7z-out\locales\es.pak

                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                  Process:C:\Users\user\Desktop\cMqyGFCQHk.exe
                                                                                                                                                                                                                  File Type:data
                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                  Size (bytes):589284
                                                                                                                                                                                                                  Entropy (8bit):5.3587509940363995
                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                  SSDEEP:6144:Uxb0Q3M9BnWhau1WK4G0gkjqpT+ZbBQihXFijs5J+f2D//z/h6PZOkx:SAwx4Lep4BQiXijs5k2r/Lzk
                                                                                                                                                                                                                  MD5:3DB06EA954C83343BD333C15947F521A
                                                                                                                                                                                                                  SHA1:DDDE6AB9F9085E83EC8BF7A37DF3389040ACEA42
                                                                                                                                                                                                                  SHA-256:45DF7340FE3C8560B11FFBA2219DE1B5C45DBFE57B6DB90BD6C246244FAE338A
                                                                                                                                                                                                                  SHA-512:CC29F1075C119DADDAA108C17ABB6D572925CAC1ED2237ED2FD45364BFB2A00C1144FCCDD22C6728C954AF2CDD1B9477F39968BA25354BCA2B9DCA07F5C53DDE
                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                  Preview:.........(..e.....h."...i.*...j.6...k.E...l.P...n.X...o.]...p.j...q.p...r.|...s.....t.....v.....w.#...y.J...z.x...|.....}...........................................$.....+.....,.....-...../.....B.....R.....g.............................2.................Z.....p.............................}...........).....D.......................>.................(.....9...........3.....x...........'.......................k ..... .....!....*!.....!.....!....6"....K"....."....?#.....#.....#....7$.....$.....$.... %.....%.....%.....&.....&....t&.....&.....&.....'....f'.....'.....'.....(.....(.....(.....)....")....{).....).....*.....*....k*.....*.....*.....+....R+.....+.....+.....+....I,.....,.....,.....,....X-.....-............................./....-/...../...../.....0....$0.....0.....1....01....C1.....1....82.....2.....2.....3....i3.....3.....3.....4....g4.....4.....4....'5....w5.....5.....5....m6.....6....Q7....h7.....7....u8.....8.....8....g9.....9.....:....%:....w:.....:.....:.....;....l;.....;.....<

                                                                                                                                                                                                                  C:\Users\user\AppData\Local\Temp\nshFAEA.tmp\7z-out\locales\et.pak

                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                  Process:C:\Users\user\Desktop\cMqyGFCQHk.exe
                                                                                                                                                                                                                  File Type:data
                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                  Size (bytes):536344
                                                                                                                                                                                                                  Entropy (8bit):5.456021867812121
                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                  SSDEEP:6144:HeaF27VNhXV9R5OJs99Z0+I+eL40dmFZxEYTHbtiPSia6OSt75H50MHsjiCKM2a6:HhFEVN53Q6Z8+wmFZq0SfH50MIW
                                                                                                                                                                                                                  MD5:8E2C2CC8C516D8B7181C0C712CA24513
                                                                                                                                                                                                                  SHA1:E0CCD9ED8DE6640379F822A067DCF97D4BBE44A7
                                                                                                                                                                                                                  SHA-256:C96937F46FB1B1182B201F5C48FE1DA4D3F94A68A0E6E0699CCC0944CD0A5A33
                                                                                                                                                                                                                  SHA-512:339BC655F22068F2EE9352A670325865265E4279197430214F7E3FBA575415318110CCCB03AED2C0E7AC673D4629BD495DC34A56CEFBCAAB62E1C4A1A87ED8C2
                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                  Preview:.........(..e.2...h.:...i.K...j.W...k.f...l.q...n.y...o.~...p.....q.....r.....s.....t.....v.....w.D...y.k...z.....|.....}...................'...../.....7.....>.....E.....L.....M.....N.....P.....`.....r...................................$.................#.....6.................U.....k...........4.....d.....v...........,.....Y.....d.................F.....Y.................C.....a...........?.....z.................^.......................f ..... ..... .....!....r!.....!.....!....7".....".....".....#....p#.....#.....#.....$....^$.....$.....$.....$....>%.....%.....%.....%....6&.....&.....&.....&....B'.....'.....'.....'....L(.....(.....(.....(....C).....).....).....)....C*.....*.....*.....*....\+.....+.....,....&,....y,.....,.....,.....-....j-.....-.....-..........d................../....f/...../...../....(0....t0.....0.....0.....0....Y1.....1.....1.....1....g2.....2.....2.....3.....3.....4....f4....z4.....5.....5.....5.....5....Z6.....6.....6.....7....\7.....7.....7.....7....>8.....8.....8

                                                                                                                                                                                                                  C:\Users\user\AppData\Local\Temp\nshFAEA.tmp\7z-out\locales\fa.pak

                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                  Process:C:\Users\user\Desktop\cMqyGFCQHk.exe
                                                                                                                                                                                                                  File Type:data
                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                  Size (bytes):876080
                                                                                                                                                                                                                  Entropy (8bit):5.051372514206481
                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                  SSDEEP:24576:nrL8u313uyqoT+seqyRmX5loTUOmdAQifaQ2XxFMJGk62YhYaiiIQMX4qOwUCMdq:ng56I
                                                                                                                                                                                                                  MD5:CAEE902136579F4BAC72A6F0F75D171B
                                                                                                                                                                                                                  SHA1:CBBAF988A499005E21FD86652E1F48AF8BCE2C35
                                                                                                                                                                                                                  SHA-256:E86F677E9654F6A16A7738E85A5A5D467A09CB18E47654F079506A00AFFAD70C
                                                                                                                                                                                                                  SHA-512:C0F2E8457F71789DA8CE207AAAE2F83196DAAC868FCAA7A84DE04DD38730F8831B9643B8A404A7AA59C5B726DA02090BBA414529019F5EB9C94AC5A5AF61BC9D
                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                  Preview:........R(..e.b...h.j...i.u...j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.B...w.n...y.....z.....|.....}.......D.....I.....Q.....Y.....a.....h.....o.....v.....x.....}...............................................>....................... .................'.....P.................%.....L...................................$ ....n ..... ....4!.....!....."....=".....".....#.....#.....$.....$....G%.....%.....%....I&.....&....7'....U'.....(.....(....4)....V)....'*.....*....u+.....+.....,.....,.....,.....,....w-..........;.....L...........l/...../...../....\0.....0....L1....a1.....1.....2.....2.....2....i3.....3..../4....B4.....4....^5.....5.....5....K6.....6....-7....>7.....7.....8.....8.....9.....9.....:....I:....l:.....;.....;.....;....1<.....<....Z=.....=.....=.....>....(?....z?.....?....?@.....@.....@.....@.....A....WB.....B.....B....qC.....D....OD....pD....nE....fF.....G....-G.....G.....H.....H....$I.....I.....J.....J.....J....~K.....K....&L....GL.....L.....M.....M.....N

                                                                                                                                                                                                                  C:\Users\user\AppData\Local\Temp\nshFAEA.tmp\7z-out\locales\fi.pak

                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                  Process:C:\Users\user\Desktop\cMqyGFCQHk.exe
                                                                                                                                                                                                                  File Type:data
                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                  Size (bytes):547257
                                                                                                                                                                                                                  Entropy (8bit):5.425790227406111
                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                  SSDEEP:12288:sXTpn19l5MtWuah5EinUtWnSp0WahHNYM:yTlB5E8nRl
                                                                                                                                                                                                                  MD5:125A121C22DFC2B1A1C759CAD9123E42
                                                                                                                                                                                                                  SHA1:D0282AF9EC311C406ECCCDFDD7216B7D883E94C3
                                                                                                                                                                                                                  SHA-256:B733460F039DCB3795077BA91DAFA3B9B8163DFD0F15168B250630F7DE21ED0A
                                                                                                                                                                                                                  SHA-512:C6E0EA8FAB8115A632D4C74141EFC46EA546F43E0B806D5BD95A1ECD3B8FE37A44565A2F79C43E0BC50DBDADC5D16054E07485FAD83C99BD3550A907C852E724
                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                  Preview:........F(%.e.J...h.R...i.c...j.o...k.~...l.....n.....o.....p.....q.....r.....s.....t.....v.0...w.\...y.....z.....|.....}.......2.....7.....?.....G.....O.....V.....].....d.....e.....f.....k.....}.......................@.................$.......................0.................G.....]...........1.....d.....y...........&.....S.....a.......................'.........................................8.....R.................0.....F.................5.....J............ ....8 ....V ..... ....@!.....!.....!.....!....K"....n".....".....".....#....A#....O#.....#.....#.....$....'$....w$.....$.....$.....$....V%.....%.....%.....%....;&.....&.....&.....&.....'....n'.....'.....'.....'....M(....v(.....(.....(....`).....).....).....*....R*....n*.....*.....*....2+....T+....m+.....+....0,....T,....c,.....,..../-....f-.....-.....-........../.....>................../....1/...../...../....&0....@0.....0....C1.....1.....1.....2....q2.....2.....2....$3....|3.....3.....3.....3....A4....Z4....j4.....4.....5....I5

                                                                                                                                                                                                                  C:\Users\user\AppData\Local\Temp\nshFAEA.tmp\7z-out\locales\fil.pak

                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                  Process:C:\Users\user\Desktop\cMqyGFCQHk.exe
                                                                                                                                                                                                                  File Type:data
                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                  Size (bytes):618874
                                                                                                                                                                                                                  Entropy (8bit):5.2024833562888055
                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                  SSDEEP:6144:fGsQ2sSp+ynDQmiSANIhxp3amx5GhV7MQoE8AYzwK:fiolx5G7s
                                                                                                                                                                                                                  MD5:EAF43729E9BBD8004EF1FF56A3D85A48
                                                                                                                                                                                                                  SHA1:34B31AB8EA2CE6BD263F00ACC50D5AF8D0222D9A
                                                                                                                                                                                                                  SHA-256:8559CC35335BB2C249297F4C7506DF95CEF899EF5F7AD942D2D511AE074D41B0
                                                                                                                                                                                                                  SHA-512:010F8E5C3B969BE0DB4BAEC3ACFFDD69BE25662387968E15E11AF0DA68EC2F45DC9EDB83CAFE7C92234E1E4E4AAE1682223235AF04D99E8B5238379E022E3D35
                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                  Preview:........*)A.e.....h.....i.0...j.<...k.K...l.V...n.^...o.c...p.p...q.v...r.....s.....t.....v.....w.)...y.P...z.~...|.....}.....................................#.....*.....1.....2.....3.....8.....E.....Z.....p.........../........... .....:...........1.....v...........3........... .....G...........<.......................`.......................s.................J.................* ..... ....@!.....!.....!..../".....".....".....#....~#.....#....*$....D$.....$....?%.....%.....%....8&.....&....$'....F'.....'.....(....0(....M(.....(.....(....#)....0).....).....).....*.....*.....*.....*....5+....K+.....+.....,....M,....\,.....,.....-....Q-...._-.....-.... .....Q....._..........."/....T/....b/...../....c0.....0.....0....41.....1.....1.....1.....2.....2.....2.....2.....3....}3.....3.....3....G4.....4.....5....75.....5.....5....(6....B6.....6.... 7....S7....n7.....7....b8.....8.....8....k9.....:....n:.....:.....;.....;.....;.....<.....<.....<....,=....D=.....=.....=....$>....:>.....>....0?....l?

                                                                                                                                                                                                                  C:\Users\user\AppData\Local\Temp\nshFAEA.tmp\7z-out\locales\fr.pak

                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                  Process:C:\Users\user\Desktop\cMqyGFCQHk.exe
                                                                                                                                                                                                                  File Type:data
                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                  Size (bytes):637414
                                                                                                                                                                                                                  Entropy (8bit):5.391270599351283
                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                  SSDEEP:12288:ZPM7ZL85Z4p5ZR6QuaMVq0YzRnP4ZoZCMYnYyGGGDYQzc7IvO8Ixat40wCSsmlFI:ZPiYVW45F2
                                                                                                                                                                                                                  MD5:651E4CB14C4F784D36D0A1715C52DCF3
                                                                                                                                                                                                                  SHA1:540F6090E3223AD8E6424A9DB78305F2DB9974BF
                                                                                                                                                                                                                  SHA-256:6D547CBC3304627D14AEB138AEBD40786C30A4192E071D80BCECDB77A13AC80A
                                                                                                                                                                                                                  SHA-512:1FE93058EC434C06EF4AA1519333EBD831311971B06D7279DDC4D86DFA860BBD6EA6D127B2A07425C3E78BD6D41C11EB2A76CF25B20C6A7DE74D1F0CEEC87079
                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                  Preview:.........(..e.....h.....i.....j.....k.....l.....n.....o."...p./...q.5...r.A...s.p...t.....v.....w.....y.....z.=...|.d...}.....................................................................................$.....3...........{.................u...........*.....B...........`.................H.................+.........................................*.....?...........4.....w...........&.......................b ..... .....!....&!.....!.....!....;"....N"....."....9#....{#.....#....($.....$.....%....4%.....%.....%....*&....A&.....&.....&.....'..../'.....'.....'..../(....A(.....(.....)....G)...._).....)....(*....\*....q*.....*....#+....O+....]+.....+.....,....<,....K,.....,.....-....A-....U-.....-....X.................7/...../...../...../....)0....{0.....0.....0.....1.....1.....1.....1....s2.....2.....3....i3.....3.....4.....4....D4.....4....05....l5.....5.....6....t6.....6.....6....c7.....7....48....G8.....8....99....~9.....9....1:.....:.....:.....;....q;.....;.....;.....<.....<.....<....7=

                                                                                                                                                                                                                  C:\Users\user\AppData\Local\Temp\nshFAEA.tmp\7z-out\locales\gu.pak

                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                  Process:C:\Users\user\Desktop\cMqyGFCQHk.exe
                                                                                                                                                                                                                  File Type:data
                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                  Size (bytes):1247969
                                                                                                                                                                                                                  Entropy (8bit):4.3234098874611675
                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                  SSDEEP:3072:dYXCzHrul8BRuh7x4kvm/RbIwjAwREJKVMjNiT7llj63rFulPCaSi5NAWsWi//Go:SgruQuhd4kOv0wv5qdhX11oG
                                                                                                                                                                                                                  MD5:6C949199EAAAD8FCB12C38EC6C02D758
                                                                                                                                                                                                                  SHA1:CE4DBD5E6A37F25354EC6849F7008956EF3568BA
                                                                                                                                                                                                                  SHA-256:966591A74E44C75C7F0114BB8E36B0E9F5502AEBDC96C714C8A8F6D45BC863C8
                                                                                                                                                                                                                  SHA-512:3344E0083969DE6F4913893A14586B441F65CB5D45F913F1CEA61B8D5ABBDB3B1C18A48731870282174263C1F306ED6B99C279627BD269E89CD4E15DC3D88313
                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                  Preview:.........(..e.....h.....i.....j.....k.)...l.4...n.<...o.A...p.N...q.T...r.`...s.....t.....v.....w.....y.....z.\...|.....}.........................................................................8.....]......................."...........B.....5...........y.......................p.................7 ..... ..... .....!....."....h"....."....H#.....#....2$....R$....5%.....%....P&.....&.....'.....(....,)....n)....D*.....+.....+.....+.....,....k-.....-.........../.....0.....0.....0.....1.....2.....3.....3....q4.....5....F5....m5....&6.....6.....7....C7.....7.....8.....8.....8.....9....s:.....:.....;.....;....|<.....<.....<.....=....S>.....>.....>....g?.....@....n@.....@....@A.....A....KB....jB....}C.....D....2E....hE....!F.....F....(G....QG.....G....VH.....H.....H....WI....8J.....J.....J.....K.....L....JM.....M....oN.....O....RO.....O....gP....-Q.....Q.....Q.....R....zS.....T....<T....cU.....V....^W.....W.....X.....Y.....Z....fZ....R[.....\.....\.....\.....]....I^.....^.....^....._.....`....ta

                                                                                                                                                                                                                  C:\Users\user\AppData\Local\Temp\nshFAEA.tmp\7z-out\locales\he.pak

                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                  Process:C:\Users\user\Desktop\cMqyGFCQHk.exe
                                                                                                                                                                                                                  File Type:data
                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                  Size (bytes):769483
                                                                                                                                                                                                                  Entropy (8bit):4.624517967326664
                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                  SSDEEP:12288:HwRkrhVzCDkVF2TWrqnV3mWqu/rHQxssACnX+8eQCajZ5Q69Zt+yr4w5ONmmEkcU:QU5J+f
                                                                                                                                                                                                                  MD5:16562C59FBA469E1DD2F3B0B87A64645
                                                                                                                                                                                                                  SHA1:9A6863205FCA8EA6D09A98B8E8DAB543FF6198A1
                                                                                                                                                                                                                  SHA-256:64FA2E98A9056E23C3A934FF39FEF81C306CEC5844D56DDA17EC6C25FCDB1B5A
                                                                                                                                                                                                                  SHA-512:DBB6E1A5E52A005386007F88B53109037792BC7B65FB95ACE3E8CC5AE3EBD8320C7E406381C375BF751A9265ACE84E0BBE1301D4BF3AA79200EC789DC3B3BC0B
                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                  Preview:........w(..e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.F...t.]...v.....w.....y.....z.....|.:...}.k.........................................................................................0.................(.....J...........H................._...........R.....r...........z.................p.........../.....@...........#.....R.....t...........o.................v ..... ....D!....h!.....".....".....".....#.....#.....#....=$....T$.....$....Y%.....%.....%....|&.....'.....'.....'....2(.....(.....(.....(....m).....).....*.... *.....*....<+.....+.....+....&,.....,.....,.....,....n-.....-....".....7............/....X/....i/...../....Q0.....0.....0.....1.....1.....1.....1....|2.....3....T3....s3.....3....[4.....4.....4....%5.....5.....5.....5....^6.....6.....7....67.....7....I8.....8.....8....>9.....9.....9.....9....R:.....:.....:.....:.....;.....<....d<.....<....\=.....>.....>.....>....X?.....?.....@....P@.....@.....A.....A.....A....wB.....B.....C....3C.....C....vD.....D

                                                                                                                                                                                                                  C:\Users\user\AppData\Local\Temp\nshFAEA.tmp\7z-out\locales\hi.pak

                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                  Process:C:\Users\user\Desktop\cMqyGFCQHk.exe
                                                                                                                                                                                                                  File Type:data
                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                  Size (bytes):1316094
                                                                                                                                                                                                                  Entropy (8bit):4.298990624339052
                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                  SSDEEP:3072:Pk/xu63zEz67Esk0GjV/BB0ZV1dKu4lYvD6OEOTByntDPtDlZpfRQhs4fe/8bR8E:8/xt3zEMEn0WXo5CKMhZQ
                                                                                                                                                                                                                  MD5:6AA92C296ED09FE2AA94DC060B25774A
                                                                                                                                                                                                                  SHA1:7619ED3DC5B1E04C55B0EE7280AC2D0135EB9C80
                                                                                                                                                                                                                  SHA-256:0C771C66DB4F80A62912564944C4E239F8DAC8381A06483ECAB512E0D75744A1
                                                                                                                                                                                                                  SHA-512:9255A4FFEF7BE07CEAB5DD8F46365B9A52D621AE175C1022BB4685FE4F3EA63425F45AA9EF824B467B9C33C51A7104258E888E8EC15C88FEA126BF0B5337FF14
                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                  Preview:........_(..e.|...h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.-...v.b...w.....y.....z.....|.....}.;.....d.....i.....q.....y.................................................................E.....~...........X.................v...........;.....i...........x.................. .....!....N!....!"....."..../#...._#.....$.....$.....%....5%.....&.....&.....'....\'.....(....e).....).....*.....*.....+....',....P,....7-.....-....e............/.....0.....1....O1.....2.....3....L4.....4....`5.....6....f6.....6....J7.....7....N8....y8.....9.....9.....9.....9.....:.....;.....;....,<.....<.....=.....=.....>.....>....{?.....?.....?.....@....;A.....A.....A....cB.....C....uC.....C.....D.....E....%F....UF.....G.....G.....H....5H.....H....QI.....I.....I....iJ.....K.....K.....K.....L....ZM.....M....4N.....N....zO.....O.....O.....P.....Q....TR.....R.....S....:T.....T.....U....qV.....W.....X.....X.....Y.....Z....$[....f[.....\.....].....^....m^....a_.....`.....`.....`.....a.....b.....c

                                                                                                                                                                                                                  C:\Users\user\AppData\Local\Temp\nshFAEA.tmp\7z-out\locales\hr.pak

                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                  Process:C:\Users\user\Desktop\cMqyGFCQHk.exe
                                                                                                                                                                                                                  File Type:data
                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                  Size (bytes):594999
                                                                                                                                                                                                                  Entropy (8bit):5.5194556553046565
                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                  SSDEEP:6144:ISmsqAZ/pqidI7/Rw6GhT0ww57V9YMrbLPDK:ISm/iEidI7/Rw6q0B5jYAzK
                                                                                                                                                                                                                  MD5:FDA338824B4171B10DCC3395A549FA9F
                                                                                                                                                                                                                  SHA1:EA42C8B18228E0CA57B8ED7ED48E3A2AEBE08486
                                                                                                                                                                                                                  SHA-256:43F370368B322CD1236632C82AA0E231965DC58FDD497F8AEAE6B40EEF9EE611
                                                                                                                                                                                                                  SHA-512:9115F805F51F45839E0A87CF44C1CCE311CECAF717C0DA7DB3B6DA85CEA95F24638AF29DA43BC01056994B22049DAA0387CD4371C13B8E5399FE8F4E38771D57
                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                  Preview:.........(..e.$...h.,...i.=...j.I...k.X...l.c...n.k...o.p...p.}...q.....r.....s.....t.....v.....w.6...y.]...z.....|.....}.........................!.....).....0.....7.....>.....?.....@.....B.....N.....Z.....h.....y.......................#.................'.....<...........3.......................s.................".............................f.......................r.................O.................<............ ....L ....d ..... ....(!...._!....s!.....!....["....."....."....U#.....#....B$....e$.....$.....%....:%....V%.....%.....%.....&.... &....f&.....&.....&.....&....D'.....'.....'.....'....H(.....(.....(.....(....G).....).....).....)....H*.....*.....*.....*....,+.....+.....+.....+....<,.....,.....,.....-....j-.....-.....-.....-....T.......................2/...../...../...../....F0.....0.....0.....1....{1.....1.....1.....2....v2.....2.....3.....3.....3.....3....P4....m4.....4....y5.....5.....5....b6.....6.....7....-7.....7.....7.....8....08.....8.....8.....8.....8....j9.....9.....:

                                                                                                                                                                                                                  C:\Users\user\AppData\Local\Temp\nshFAEA.tmp\7z-out\locales\hu.pak

                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                  Process:C:\Users\user\Desktop\cMqyGFCQHk.exe
                                                                                                                                                                                                                  File Type:data
                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                  Size (bytes):640919
                                                                                                                                                                                                                  Entropy (8bit):5.644940180075165
                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                  SSDEEP:6144:oeo/GHgmRXxhsRd9gHo2pKJDAxukitluTd5kt8zZ9pwJcYNV9SLg+4ev6DbnjDiw:Ho/GBwHAZd5kt8Ex9y+O5LG9b
                                                                                                                                                                                                                  MD5:7ADD28FBBBA1CE87972F6433862DCBAA
                                                                                                                                                                                                                  SHA1:8B4B0053663C0B69BECA59FACA79854A89AB9C97
                                                                                                                                                                                                                  SHA-256:DD86976D72F3CB644B90C1863E29E2F8616B09AC4ACFE9301FB346FA0D87BD78
                                                                                                                                                                                                                  SHA-512:EFED0891B0202BAE9396DF54F141A73BB6CCADD7947330FD9E6A3A8911E9E037454238C4BD2BB9075AF3218230C9E4E394F83A70878396911FAA282D99FDD884
                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                  Preview:........w(..e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.D...t.[...v.....w.....y.....z.....|.8...}.i.....................................................................................................~.............................L....._...........c................._.................'.................(.....9.................H.....i...........i.................s...........X ....| ..... ....b!.....!.....!....!"....."....."....."....s#.....#....6$....P$.....$....s%.....%.....%....\&.....&.....'....-'.....'.....(....,(....D(.....(.....)....G)...._).....).....*.....*.....*....U+.....+....+,....A,.....,....L-.....-.....-............................Z/...../.....0....B0.....0....W1.....1.....1....#2.....2.....2.....2....J3.....3.....3.....3....`4.....4.....5.....5.....5.....6....i6.....6.....7....U7....y7.....7.....7....T8.....8.....8....(9.....9.....9.....9.....:....,;.....;.....;....R<.....<...."=....V=.....=....e>.....>.....>....8?.....?.....?.....?....q@.....@....'A

                                                                                                                                                                                                                  C:\Users\user\AppData\Local\Temp\nshFAEA.tmp\7z-out\locales\id.pak

                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                  Process:C:\Users\user\Desktop\cMqyGFCQHk.exe
                                                                                                                                                                                                                  File Type:data
                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                  Size (bytes):529383
                                                                                                                                                                                                                  Entropy (8bit):5.3800306514954634
                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                  SSDEEP:6144:MB38e1B6x8b+tQqAHcAef+eVnjHF/TmiZAWO5AVpWOBhUnNiT8kLHp:MB38erqPA2VnjHFbm8At5AVpLp
                                                                                                                                                                                                                  MD5:CFC848689A25F5E2E6BA9A06E09B6EE0
                                                                                                                                                                                                                  SHA1:35131E775D98A57FFCBD6A75E69F6F67437636C3
                                                                                                                                                                                                                  SHA-256:EC1D7BBE064656DC53F70E3A612A582F5D5D0AF5F0C2D6A783796CFFA5BF7F57
                                                                                                                                                                                                                  SHA-512:D5A027E35DD3846F5255B81EED36A3498AC9D809367692B2DA216B5771C2D54FAD35FC15C15705A2BBB4A7B35DD2245661882734998F9BC3AD8D62D2273B6577
                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                  Preview:.........(..e.....h.....i.....j.....k.(...l.3...n.;...o.@...p.M...q.S...r._...s.....t.....v.....w.....y.-...z.[...|.....}......................................................................... .....-.....=.....O...........5.....}.................6.....c.....o...........6.....y.................P.......................K.....{.......................=.....T.................B.....f.................P.....g.................4.....A.......................#.................$ ....7 ..... .....!....W!....k!.....!.....!....."....."....g"....."....."....."....-#....x#.....#.....#.....$....Y$.....$.....$.....$....>%....m%....w%.....%.....&....B&....L&.....&.....&.....'....('.....'.....'.....(.....(....q(.....(.....(.....)....Y).....).....).....).....*....T*....s*.....*.....*....2+....]+....p+.....+.....,....G,....i,.....,.....,.....-.....-....w-.....-.....-..........v................../...../.....0....f0....u0.....0....?1....y1.....1.....1....F2....t2.....2.....2.....3....,3....<3.....3.....3....24

                                                                                                                                                                                                                  C:\Users\user\AppData\Local\Temp\nshFAEA.tmp\7z-out\locales\it.pak

                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                  Process:C:\Users\user\Desktop\cMqyGFCQHk.exe
                                                                                                                                                                                                                  File Type:data
                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                  Size (bytes):581016
                                                                                                                                                                                                                  Entropy (8bit):5.296715563664076
                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                  SSDEEP:6144:Mkqu5NjNJ2IU9UTx994eN7NgvESIqRRxsO1ytnvWjRT9Tj+rhazYDxrvAqpzSw9S:MkSLlZm128uJekfzEpe5kLISa
                                                                                                                                                                                                                  MD5:6AA3BC3EE4999C324B82E50940E62C74
                                                                                                                                                                                                                  SHA1:10AF8030FC2F875E133C9417E0221528160AD8B5
                                                                                                                                                                                                                  SHA-256:73CC8422643A65753B2C3672C8F8331EE92C9BDDC912576554E95B0986CF990D
                                                                                                                                                                                                                  SHA-512:F039EF32002E55D09A4F567CC81FE2B3B329D517C985436A5DA121FF0E6AC7E258B5D1FDDA81E6C1578DAF7078B91ABCFB7DA98CDBA6693D4FBE7F28115E6971
                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                  Preview:.........(..e.....h.....i.....j.....k.....l.!...n.)...o.....p.;...q.A...r.M...s.|...t.....v.....w.....y.....z.I...|.p...}...............................................................................".....;.....L...........u.................d...................................r...................................G............................._.......................v................._.................S..........." ....h ....y ..... ....9!....s!.....!.....!....`"....."....."....G#.....#.....$....,$.....$.....$.....%....$%....t%.....%.....%.....%....@&.....&.....&.....&....#'.....'.....'.....'....+(....~(.....(.....(.....)....Y).....).....).....)....-*....[*....d*.....*.....+....:+....E+.....+....,,....z,.....,.....,....6-...._-....x-.....-.....-.................................../...../...../..../0....l0.....0.....1....31....H1.....1.....1.....2....!2.....2.....3....Y3.....3.....4.....4.....4.....5.....5.....6....[6.....6.....7....r7.....7.....7....!8....a8.....8.....8.....9....c9.....9

                                                                                                                                                                                                                  C:\Users\user\AppData\Local\Temp\nshFAEA.tmp\7z-out\locales\ja.pak

                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                  Process:C:\Users\user\Desktop\cMqyGFCQHk.exe
                                                                                                                                                                                                                  File Type:data
                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                  Size (bytes):708098
                                                                                                                                                                                                                  Entropy (8bit):5.712005061370792
                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                  SSDEEP:6144:SCG5Mw77QWN7v5DD79ZgQ21XymbA5zFLdbvVt:SrSw7NN7F9ZgQ21Xi5zFLdj
                                                                                                                                                                                                                  MD5:5A69547F56DC61E482DCDA1CE704C5AC
                                                                                                                                                                                                                  SHA1:5B7BBC8E9B14D78F2105136AFB7728050128C02E
                                                                                                                                                                                                                  SHA-256:A286A5FAF9021927EC09FD8CBF30ED14AD59C3BAA36D29E5491AD27B957915E5
                                                                                                                                                                                                                  SHA-512:2B9D020544201E2D0B0B44B0977FCBAB858563969CE02BE65689C5F5B780ADC4560DF523589293CD66F42903322ED61D781DA093ADFA44AA0681A28D97DE4556
                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                  Preview:.........'..e.f...h.n...i.y...j.....k.....l.....m.....o.....p.....q.....v.$...w.P...y.w...z.....|.....}.......&.....+.....3.....>.....F.....U.....Z.....b.....i.....p.....w.....y.....~.........................................l...................................p...........S.....n.....4...........P.....{...........k.......................|.................H............................. .....g.................h ..... ..... .....!.....!.....!.....!....6".....".....".....".....#....4$.....$.....$.....%....w%.....%.....%....;&.....&.....&.....'.....'....%(....l(.....(....4).....).... *....D*.....*....I+.....+.....+....#,.....,.....,.....,....j-.....-..........+...........6/...../...../....80.....0....(1....G1.....1....A2....{2.....2.....3.....3.....3.....3....Z4.....4.....5....35.....5....?6.....6.....6....*7.....7.....7.....7....B8.....8.....8.....9.....9.....9.....:....5:.....:....|;.....;.....;.....<.....=...._=.....=.....>.....>.....>.....>....z?.....?...."@....>@.....@....LA.....A.....A

                                                                                                                                                                                                                  C:\Users\user\AppData\Local\Temp\nshFAEA.tmp\7z-out\locales\kn.pak

                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                  Process:C:\Users\user\Desktop\cMqyGFCQHk.exe
                                                                                                                                                                                                                  File Type:data
                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                  Size (bytes):1424056
                                                                                                                                                                                                                  Entropy (8bit):4.241400387342817
                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                  SSDEEP:12288:X3WMqESgQzb4OpsJHVLl6S3AE745LmWA4hqSm2G:Nqed65qWo
                                                                                                                                                                                                                  MD5:52A0707A70B939BCD75B0838A5DC5357
                                                                                                                                                                                                                  SHA1:EB9E1350D9D217580B1939302D008DC07C3B781C
                                                                                                                                                                                                                  SHA-256:B177EDA102B1BE8C53127E3BB47970A3C1E2032BE24900D8A126C5F0F077EF3D
                                                                                                                                                                                                                  SHA-512:D5FE69035338C4308F661FA0AC25C4A811A6014F6BD85CCC7AD947F76AECF76F67208512E1266E249EC067A5FB22FB74A3550B0F3AEB1BC50FADB3A9D3CC67E4
                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                  Preview:.........(..e.B...h.J...i.[...j.g...k.v...l.....n.....o.....p.....q.....r.....s.....t.....v.(...w.T...y.{...z.....|.....}.......*...../.....7.....?.....G.....N.....U.....\.....].....^.....c.......................].............................D.....L...........[.................. ..... .....!....."....`#.....#....\$.....$....S%.....%....t&....='.....'.....'.....).....)....t*.....*....5,....D-..........|....../....V0.....0....%1....42.....3.....3.....3....,5....B6.....7....T7.....8.....9.....:....C;.....;....u<.....<.....<.....=....C>.....>.....>....X?.....?....A@....V@....9A.....A....zB.....B.....C....BD.....D.....D.....E....EF.....F.....F.....G....sH.....H.....I.....I.....J.....K....CK....eL....dM....$N....SN....6O.....O....TP.....P....AQ.....Q.....R..../R.....S.....S....1T....cT.....U....SV.....V....hW....PX.....X....UY.....Y.....Z.....[....*\....|\.....].....^....W_....._....+a.....b.....c.....c....;e....9f.....f....og.....h.....i....2j.....j....Lk.....k...._l.....l.....m.....n....`o

                                                                                                                                                                                                                  C:\Users\user\AppData\Local\Temp\nshFAEA.tmp\7z-out\locales\ko.pak

                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                  Process:C:\Users\user\Desktop\cMqyGFCQHk.exe
                                                                                                                                                                                                                  File Type:data
                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                  Size (bytes):599188
                                                                                                                                                                                                                  Entropy (8bit):6.077314293748852
                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                  SSDEEP:12288:Twg3X8cvlA/t0ZTvIXzxMSAG0GlzRXhw3zTt8Onat7DXCqYwHs5Ra1i7vlq5zULq:TH75vKpCWj
                                                                                                                                                                                                                  MD5:4B563EB612D4FADC6BD8A4C918006AB1
                                                                                                                                                                                                                  SHA1:4B9E414AF0C044C4487D1439D23EF11B0169D308
                                                                                                                                                                                                                  SHA-256:E0D4461452607E0F4A619EFE653EC9EC39F7D34A742AE98374B2BCE0B821ADC9
                                                                                                                                                                                                                  SHA-512:B8C56D69FA41AD14F7197ACAB1BA987EBB06C5B15748E21CEC27861721545E30FB20F76F2C3A752C8EA94CCA1E6B4FAB7FB0727B679A8FB8E94DB2D5C028E7A6
                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                  Preview:.........'..e.....h.....i.%...j.0...k.\...l.d...m.l...o.....p.....q.....r.....s.....t.....y.'...z.U...|.|...}.........................................................................+.....;.....N.....^...........Q.................(.......................[.................#.................5.....I.................<.....L.................?.....R.................B.....]...........;.....p.................?.....m.....z...........1.....].....j...........<.....t............ ..... ..... ..... ....P!.....!.....!.....!....0"....~".....".....".....#....Y#....~#.....#.....$....r$.....$.....$....3%.....%.....%.....%....>&.....&.....&.....&....E'.....'.....'.....'....B(.....(.....(.....(....`).....).....*..../*.....*.....*.....*.....+.....+.....+.....,.....,.....,.....,.....-.....-.....-..........L.....|............/...../....+/...../...../.....0....(0.....0.....0.....1....-1.....1....+2....q2.....2.....2....X3.....3.....3.....4....h4.....4.....4.....5....]5....}5.....5.....5....R6.....6.....6.....7

                                                                                                                                                                                                                  C:\Users\user\AppData\Local\Temp\nshFAEA.tmp\7z-out\locales\lt.pak

                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                  Process:C:\Users\user\Desktop\cMqyGFCQHk.exe
                                                                                                                                                                                                                  File Type:data
                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                  Size (bytes):644262
                                                                                                                                                                                                                  Entropy (8bit):5.6356477666035865
                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                  SSDEEP:12288:kjFt+0US0MAcrMqecJwuxZ5b7MjC3jqt6S0M:WFQ0GMnrLZ5sjIjqN
                                                                                                                                                                                                                  MD5:7CEF6E31D76861DB4D7D622FDD89E5AA
                                                                                                                                                                                                                  SHA1:31FA45C3B7666259D4D8A13518ECE423A97EDCCA
                                                                                                                                                                                                                  SHA-256:2F1E1C69DA5CAD8F47E45AF0AC47CEC90C20FE2897A43CB496C7FEED1EC5D1AB
                                                                                                                                                                                                                  SHA-512:DF66A739F3A8DA62A942B56B23F71A2B68469E87DC44EB8CE1A9A859A609F1DB4BEE2497DEFEF06FA48E14CF461E61410668A5216459C94C79F4B69A3CF092F6
                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                  Preview:.........(..e.....h.....i.#...j./...k.>...l.I...n.Q...o.V...p.c...q.i...r.u...s.....t.....v.....w.....y.C...z.q...|.....}.................................................$.....%.....&.....(.....6.....C.....W.....h....................... ...........6.....}...........0.................$.................S.....m...........f.................$.......................w...........%.....J...........] ..... ..... ....5!.....!.....!.....!....j".....".....#.....#.....#....F$.....$.....$....7%.....%.....&....3&.....&.....'....<'....W'.....'....:(....j(....|(.....(....h).....).....)....(*.....*.....*.....*....m+.....+....',....6,.....,....4-....o-.....-............................6/...../...../...../.....0....%1....x1.....1.....2....|2.....2.....2....W3.....3.....4....<4.....4.....5....d5....|5.....6.....6.....6.....6....l7.....7.....7.....8.....8....19....s9.....9....$:.....:.....:.....;.....;....T<.....<.....<....G=.....=.....>....)>.....>....[?.....?.....?.....@....r@.....@.....@....+A.....A.....A

                                                                                                                                                                                                                  C:\Users\user\AppData\Local\Temp\nshFAEA.tmp\7z-out\locales\lv.pak

                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                  Process:C:\Users\user\Desktop\cMqyGFCQHk.exe
                                                                                                                                                                                                                  File Type:data
                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                  Size (bytes):643309
                                                                                                                                                                                                                  Entropy (8bit):5.637177021245093
                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                  SSDEEP:6144:Uz9waCt7x2/28mvsf4xN3tVF89voxEJiiUh/7bOEw5hp1UrFeTE/CoCKbnh2Degl:UFuKvNMEGFOEw5WFeTunbf35S
                                                                                                                                                                                                                  MD5:00B517CE675A3089823708776C6F9302
                                                                                                                                                                                                                  SHA1:2BC24F150ADAAFD2604C5D95BBAAF8DC983D7DA2
                                                                                                                                                                                                                  SHA-256:0ADEDD1EAAF902FEEBB208220D9F21AE1B0175E74F6A966CD7ED226146D86AE8
                                                                                                                                                                                                                  SHA-512:6C19A0D779185141FB050369F9FBFE60D0B838E55E2674E3F14A67E1A6970727E329656E458CA8516A41C97B20E67EB1789587AF957129B3D32C94A3536AB12E
                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                  Preview:.........(..e.L...h.T...i.e...j.q...k.....l.....n.....o.....p.....q.....r.....s.....t.....v.2...w.^...y.....z.....|.....}.......4.....9.....A.....I.....Q.....X....._.....f.....g.....h.....j.....}.......................\...........k...................................\...........R.....o.............................:.......................j...........2.....D...........4.....f...........% ..... .....!....A!.....!....B".....".....".....#.....#.....#.....#...._$.....$....E%....b%.....%.....&.....&.....'....X'.....'.....'.....(....b(.....(.....(.....)....n).....).....*.....*.....*....0+....u+.....+.....+....p,.....,.....,.....-.....-.....-.....-....N............/...../...../.....0....G0....X0.....0.....1.....1.....1....K2.....2.....2.....2....`3.....3.....4....=4.....4.....5....15....@5.....5...._6.....6.....6....:7.....7.....7.....7....b8.....8.....9....39.....9....1:....u:.....:....+;.....;....P<....c<.....<....f=.....=.....=....5>.....>.....>.....?....o?.....?.....?.....@.....@....-A....qA

                                                                                                                                                                                                                  C:\Users\user\AppData\Local\Temp\nshFAEA.tmp\7z-out\locales\ml.pak

                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                  Process:C:\Users\user\Desktop\cMqyGFCQHk.exe
                                                                                                                                                                                                                  File Type:data
                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                  Size (bytes):1481376
                                                                                                                                                                                                                  Entropy (8bit):4.274098791777635
                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                  SSDEEP:12288:gtUOGVx75aWEyghv479y6DPnXKfhBP1zXnxooG98MF3e7hDK5V6jX9fb3VV:gtuxmGKfhBP1zX23F3ek5V6jX9D3j
                                                                                                                                                                                                                  MD5:D32A29A61E8AFABA6B42D236257D9929
                                                                                                                                                                                                                  SHA1:9664F50EA7590A47C2EB8EB4A3E49BE556D08F7A
                                                                                                                                                                                                                  SHA-256:A59FD15C969EE8FFD7E72F5A2245C6A5A4FC048F7899FCA489D78C8F6394CA1E
                                                                                                                                                                                                                  SHA-512:2668976853B26B22859F8C20AFAEB4D641845E94779B8994B49F240302420279E3F9A99666B8F551495B7D5A8C3C83609B7ECF276FABD8345CC8C787319EA3D2
                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                  Preview:.........(..e.@...h.H...i.Y...j.e...k.t...l.....n.....o.....p.....q.....r.....s.....t.....v.&...w.R...y.y...z.....|.....}.......(.....-.....5.....=.....E.....L.....S.....Z.....[.....\.....a.......................j...........<.....+.....x.................B.................] ....L!.....!.....".....#....h$.....$.....%....Y&.....&.....'.....'.....(....t).....).....*....n+.....+....4,.....-..........X/...../.....0.....1....W2.....2.....3.....4.... 5....d5.....6.....7....o8.....8....I:.....;.....<.....<.....=....U>.....>.....>.....?....g@.....@.....@.....A.....B.....B.....C.....C.....D....AE....uE....YF.....F....pG.....G.....H....YI.....I.....J.....J.....K....BL.....L....NM.....N.....N.....N.....O.....P.....Q.....Q.....R.....S.....T....DT.....U.....U.....U....?V.....W.....W.....X.....X.....Y.....Z.....[.....[.....\.....].....^....E^....g_....^`.....`....?a....~b....@c.....c....>d....le.....f....dg.....g.....h.....i.....j.....j.....l.....m.....m.....n.....n.....o....Pp.....p.....q.....r.....s

                                                                                                                                                                                                                  C:\Users\user\AppData\Local\Temp\nshFAEA.tmp\7z-out\locales\mr.pak

                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                  Process:C:\Users\user\Desktop\cMqyGFCQHk.exe
                                                                                                                                                                                                                  File Type:data
                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                  Size (bytes):1222173
                                                                                                                                                                                                                  Entropy (8bit):4.300698800250203
                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                  SSDEEP:3072:gOG1c9CX6VI4KBYmiMpvVL8lownlWGrInbizwF/yGRu3RxYR3GodgEWYJrOznupW:fG0m4lwcasmKZKbzNvfq1E5imHReZ
                                                                                                                                                                                                                  MD5:0E5B29B6AE74A1F94CA4F880F131A79F
                                                                                                                                                                                                                  SHA1:6AC5089ACE05847480D2AEEC89954124CAA781AA
                                                                                                                                                                                                                  SHA-256:25BF8E86F7C9E88F68D4C40C4F124C16F60DAF22E7A87F55BA2C560A0F640BC9
                                                                                                                                                                                                                  SHA-512:30717C0AEF4458BBCF7472316727981829EDADA8BE3003AFD9D65CB01D4CF309F601B1C41539343D6239CB2E9157554C95CF966A4156458A2FD78D2464075C98
                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                  Preview:........q(..e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.C...t.Z...v.....w.....y.....z.....|.7...}.h...................................................................................-.....z.....................................................R...........U............ .....!....6"....b"....5#.....#....P$.....$....^%....-&.....&.....&.....'.....(.....)....T).....*.....,.....,....5-....S.....V/...../....$0....K1....K2.....2.....3....C4....a5.....6....J6.....7.....8.....9.....:.....;.....;....9<....s<....6=.....=....+>....W>.....?.....?.....?.....@.....A.....A....\B.....B....|C....RD.....D.....D.....E....uF.....F.....F.....G....uH.....H.....H.....I.....J.....J.....K....RL....{M....=N....|N....;O.....O....4P....]P.....P.....Q.....Q.....Q.....R.....S.....T....+T....TU....OV.....V....eW....OX.....Y....mY.....Y.....Z.....[....k\.....\.....].....^....n_....._.....`....Qb....:c....ac.....d.....e...._f.....f.....g.....h.....i....]i.....j.....j....Wk.....k.....l.....m....!n

                                                                                                                                                                                                                  C:\Users\user\AppData\Local\Temp\nshFAEA.tmp\7z-out\locales\ms.pak

                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                  Process:C:\Users\user\Desktop\cMqyGFCQHk.exe
                                                                                                                                                                                                                  File Type:data
                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                  Size (bytes):554824
                                                                                                                                                                                                                  Entropy (8bit):5.250627975386066
                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                  SSDEEP:6144:1fZuPdEaPHdoDKUaxe+2cgFRlWWNxTUcWR95bxlqyGkuBm9ch:xg9HEsxd2hlWEG95vFG3
                                                                                                                                                                                                                  MD5:6149507C3AA99C4012D9D7CFE4BC30C8
                                                                                                                                                                                                                  SHA1:51A2BB5CBAE64F3877AFC342EA0F43915702F8F4
                                                                                                                                                                                                                  SHA-256:DD75481D67D9BE36ECB2E421117395FBB75B7623164F13A09BE1CF3CE76D588F
                                                                                                                                                                                                                  SHA-512:71F8DC03618D46BE7B036353526BF20A61E648EF50ADEEEC057D314E9A4536899C37EF691164BF9DE9E10A3867749F8D3D6F4038E16C82CF6122E7AB4A1C7732
                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                  Preview:.........(..e.^...h.f...i.n...j.z...k.....l.....n.....o.....p.....q.....r.....s.....t.....v.;...w.g...y.....z.....|.....}.......=.....B.....J.....R.....Z.....a.....h.....o.....p.....q.....v.............................d...........4.....O.................B.....R...........0.....q.................^.......................f.......................[.......................`................./.......................P.......................- ..... ..... ..... .....!....y!.....!.....!....8".....".....#.....#...._#.....#.....#.....#....!$....t$.....$.....$.....$....G%....n%....z%.....%....A&....{&.....&.....&....I'....~'.....'.....'....?(....q(....{(.....(....-)....])....f).....).... *....S*....^*.....*....A+.....+.....+.....+....B,....g,.....,.....,...."-....F-....`-.....-.....-....(.....9................../....@/...../...../...../...../....U0.....0.....0.....0....e1.....1.....1.....2.....2.....3...._3....m3.....3....<4....w4.....4.....4....I5....w5.....5.....5.....6....;6....K6.....6.....6....&7

                                                                                                                                                                                                                  C:\Users\user\AppData\Local\Temp\nshFAEA.tmp\7z-out\locales\nb.pak

                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                  Process:C:\Users\user\Desktop\cMqyGFCQHk.exe
                                                                                                                                                                                                                  File Type:data
                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                  Size (bytes):537830
                                                                                                                                                                                                                  Entropy (8bit):5.4264919827777245
                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                  SSDEEP:12288:GFxHxFb73kroOp7fBpHXYbhOs5wk+bhPLgg5t:GXxFXkJ1YbhOs5f+bFUG
                                                                                                                                                                                                                  MD5:2A0EC73D03D4D7FCEC71AD66CC0D4B30
                                                                                                                                                                                                                  SHA1:BB8DF6E11B02086726ECEDE97D5F729F4197323C
                                                                                                                                                                                                                  SHA-256:D44EF5E644B1B8F7C056D5E20651515FCC8565BEFEC575091735FB39C6D63554
                                                                                                                                                                                                                  SHA-512:CDCB4E436270156E263D731CE243D821C5361B18B6D7B8259875C9D895301D478A87FEB7CAFC3376D09D18D27F32DC403FD2CBD034D68736CB968BBEFEBD642B
                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                  Preview:.........(..e.....h. ...i.7...j.C...k.R...l.]...n.e...o.j...p.w...q.}...r.....s.....t.....v.....w.0...y.W...z.....|.....}...............................#.....*.....1.....8.....9.....:.....<.....G.....V.....i..................................._...................................n.................P.......................M.....w.................:.....c.....r...........B.....r.................w.................`...........- ....L ..... ....&!....^!....r!.....!....r"....."....."....m#.....#....J$....l$.....$.....%.....%....'%....}%.....%.....%.....&....`&.....&.....&.....&....I'.....'.....'.....(...._(.....(.....(.....(....a).....).....).....*...._*.....*.....*.....*....Q+.....+.....+.....+....`,.....,.....-....5-.....-.....-................x................../....[/...../...../...../....b0.....0.....1....F1.....1.....1.... 2....92.....2.....3....23....J3.....3.....4....J4....^4.....4....95....u5.....5.....6.....6.....6.....7....o7.....7.....7.....8....Y8.....8.....8.....8....<9.....9.....9

                                                                                                                                                                                                                  C:\Users\user\AppData\Local\Temp\nshFAEA.tmp\7z-out\locales\nl.pak

                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                  Process:C:\Users\user\Desktop\cMqyGFCQHk.exe
                                                                                                                                                                                                                  File Type:data
                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                  Size (bytes):556268
                                                                                                                                                                                                                  Entropy (8bit):5.362124110769206
                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                  SSDEEP:12288:jVAWY0lbJ9WQusFUiFgN5tmDdx5btfKzaWDZqqn9pmTy:qWY0lbJ9WQusFU15tmDdx5bFKzaWVqq1
                                                                                                                                                                                                                  MD5:E8B790166D701F63A60C3B322FCCE234
                                                                                                                                                                                                                  SHA1:61EC318AA8030F7D29C3258126B156D1D3EEFA2C
                                                                                                                                                                                                                  SHA-256:3D73B0110E5832B6A7C7B7E64018368464EF8552D6A98592D0ADBF713EB9755E
                                                                                                                                                                                                                  SHA-512:4E4B299CB55CBB5906FF974BB5E5078D2018298B5EE6D9CA0E40AAB8DB542AAEDC4BD7A5DB242A2C5194BC90C07631F627043DCC1A9F2D095A28C3E35F212DD9
                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                  Preview:.........(..e.....h.....i.....j.....k."...l.-...n.5...o.:...p.G...q.M...r.Y...s.....t.....v.....w.....y.'...z.U...|.|...}...............................................................................(.....9.....K...........m.................W.......................{...........3.....I.................L.....c.................7.....F.......................(.................7.....X...........0.....g.................E.....z.................T ..... ..... .....!.....!.....!.....!....[".....".....#....3#.....#.....#.....#.....$....X$.....$.....$.....$....,%....}%.....%.....%.....&....|&.....&.....&.....'....u'.....'.....'.....(....U(.....(.....(.....(....4)....`)....m).....)....)*....]*....l*.....*....H+.....+.....+.....,....W,.....,.....,.....,....=-....^-....u-.....-....+.....S.....e...........7/....n/...../...../....<0....Z0....n0.....0....21....d1....u1.....1....G2.....2.....2....-3.....3.....4.....4.....4.....5....D5....i5.....5....46....e6....z6.....6.....7....A7....Q7.....7.....8....A8

                                                                                                                                                                                                                  C:\Users\user\AppData\Local\Temp\nshFAEA.tmp\7z-out\locales\pl.pak

                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                  Process:C:\Users\user\Desktop\cMqyGFCQHk.exe
                                                                                                                                                                                                                  File Type:data
                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                  Size (bytes):619265
                                                                                                                                                                                                                  Entropy (8bit):5.770526396702215
                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                  SSDEEP:12288:zifPIC1WoOB/ktv/XfQfuzSJY9HQbyDPSCUd4e3m7UyMgmx1QhH1b5FuH4VZy:YTxbMJ1Qh15w
                                                                                                                                                                                                                  MD5:8A4354163FF3B0978A568F781BDAC289
                                                                                                                                                                                                                  SHA1:45DE421F35AF79ADF962809CF8D0E6D2ADBCB553
                                                                                                                                                                                                                  SHA-256:2F6DE0F9A46AE0B75BEB67E09FFEEE12483842A7CD6F2A2382CCBE36FBFC17E3
                                                                                                                                                                                                                  SHA-512:5760F20228AFE74E9FF2A916A168E8CC2D4A64D8E76065E61A7A60616A473C7DC3DA4805125B270F179B7A0F291071E81D761D82EEC3B130D552B57ABD76C127
                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                  Preview:.........(..e.....h.....i./...j.9...k.H...l.S...n.[...o.`...p.m...q.s...r.....s.....t.....v.....w.&...y.M...z.{...|.....}..................................... .....'.........../.....0.....2.....A.....O.....d.....y.........................................%.....8...........M.......................u................./.......................(.......................I...................................I.....n...........8 ....p ..... ..... ....M!.....!.....!.....".....".....".....".....#.....$....d$.....$.....$....$%....9%....Z%.....%.....%.....&....&&....o&.....&.....&.....&....O'.....'.....'.....'....](.....(.....(.....(....Y).....).....).....)....J*.....*.....*.....*....:+.....+.....+.....+....Q,.....,.....-....+-....y-.....-.....-.....-....Y.......................E/...../...../...../....g0.....0.....1....@1.....1.....1.....1.....2....s2.....2.....2.....3.....3.....3....+4....E4.....4....85.....5.....5....%6.....6.....6.....7....c7.....7.....7.....7....@8.....8.....8.....8....$9.....9.....9

                                                                                                                                                                                                                  C:\Users\user\AppData\Local\Temp\nshFAEA.tmp\7z-out\locales\pt-BR.pak

                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                  Process:C:\Users\user\Desktop\cMqyGFCQHk.exe
                                                                                                                                                                                                                  File Type:data
                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                  Size (bytes):581655
                                                                                                                                                                                                                  Entropy (8bit):5.426534241883623
                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                  SSDEEP:6144:mHM4QhMCJi4wNNBXBLGfs9y+z5GHNXun0msRgMpI2:CchHi4wD50XosR9pN
                                                                                                                                                                                                                  MD5:B1AB7D7AA67A7B61BFA9AEBAD0B812AF
                                                                                                                                                                                                                  SHA1:95EFF4BE517C0A25C34578DEF10D48C77021DE1A
                                                                                                                                                                                                                  SHA-256:5BD503C413AAF8FA87FD47C341D437ACCC25397A50B082068BCF2F3BB4FB27C7
                                                                                                                                                                                                                  SHA-512:8498FE7727771DF3C1EB34560C1E25B0C30690C7C921104B4ADCF04CC5753462BAC513A60A5833CB6F57733201D4883605F8A4EC4A457F3EBC7C952090B1A9E1
                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                  Preview:.........(..e.....h.....i.-...j.9...k.H...l.S...n.[...o.`...p.m...q.s...r.....s.....t.....v.....w.&...y.M...z.{...|.....}..................................... .....'.........../.....0.....5.....G.....W.....y.............................%.................%.....5...........R.................4.......................6.............................r.................G.................'.................d................._ ..... ..... .....!....}!.....!.....!....J".....".....#....!#.....#....-$.....$.....$.....$....>%....d%....w%.....%.....&....d&....s&.....&....+'....`'....n'.....'....4(....o(.....(.....(....-)....^)....j).....).....*....:*....D*.....*.....*.....+.....+....}+.....+.....,....$,.....,.....-....q-.....-.....-....'.....K.....`................../....y/...../...../.....0.....0.....1....F1.....1.....1.....2....-2.....2.....2.....2.....3.....3.....3....(4....D4.....4....D5.....5.....5....A6.....6.....6....'7.....7.....7.....8.....8....e8.....8.....8.....8....`9.....9.....:....!:.....:

                                                                                                                                                                                                                  C:\Users\user\AppData\Local\Temp\nshFAEA.tmp\7z-out\locales\pt-PT.pak

                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                  Process:C:\Users\user\Desktop\cMqyGFCQHk.exe
                                                                                                                                                                                                                  File Type:data
                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                  Size (bytes):585544
                                                                                                                                                                                                                  Entropy (8bit):5.398721361990628
                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                  SSDEEP:6144:EdZCITRW+kQdJs7ieJVJJxhbHMm5wfBCV5z6jPdoSR7oF:6XJksvMV5+jPSSR7Y
                                                                                                                                                                                                                  MD5:CBE5E35F844F5F1400DF3685CC847694
                                                                                                                                                                                                                  SHA1:E60CDB0A813A97C8548C878276BFAE155350BB42
                                                                                                                                                                                                                  SHA-256:6B9BD714D217D596183894FFED3174A617E1C8CFAE292231D4B967183B589C6B
                                                                                                                                                                                                                  SHA-512:96046C97436A3DBF5AAC479B9EAA9DFDCFC81F1EDCAEE9CD65D59BEB0CE6B6B42828E0D170AAEF2EF1D68988F7916AC1DBAC0D84218DE83FEDCCA8592DE4C1F1
                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                  Preview:.........(..e.X...h.`...i.q...j.}...k.....l.....n.....o.....p.....q.....r.....s.....t.....v.>...w.j...y.....z.....|.....}.......@.....E.....M.....U.....].....d.....k.....r.....s.....t.....y.............................U...........=.....Z...........%.....p...............................................8.....\.................).....9.........................................O.....}...........].................- ..... ..... ..... ....L!.....!.....!....."....i".....".....#....3#.....#....)$.....$.....$.....$....U%.....%.....%.....%....C&....t&.....&.....&....F'.....'.....'.....'....V(.....(.....(.....(....W).....).....).....)....:*....g*....q*.....*.....+....@+....J+.....+.....,....5,....F,.....,....$-....t-.....-.....-....4.....^.....z................../....$/...../...../.....0..../0.....0.....1....U1.....1.....1.....2....H2....Z2.....2.....3....>3....S3.....3.....4....b4....|4.....5.....5.....5.....5....u6.....6....,7....P7.....7....38....s8.....8.....8....'9....L9....a9.....9..../:....k:

                                                                                                                                                                                                                  C:\Users\user\AppData\Local\Temp\nshFAEA.tmp\7z-out\locales\ro.pak

                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                  Process:C:\Users\user\Desktop\cMqyGFCQHk.exe
                                                                                                                                                                                                                  File Type:data
                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                  Size (bytes):606335
                                                                                                                                                                                                                  Entropy (8bit):5.4540537912984615
                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                  SSDEEP:6144:kxrPkiHXWrfGENd49ow6q0gdKXKkQGXq5e3jUZGs2hj/Xrbf:CrxXWr3Nu9o7qHKasq5ezUuj/3f
                                                                                                                                                                                                                  MD5:5DB10EDF772656C0808DD8DA698334BF
                                                                                                                                                                                                                  SHA1:3CAF7C9D5A3B44E06E0588DABA698B6970EA06F5
                                                                                                                                                                                                                  SHA-256:73B6A63352906D77196F38A1DF937EC0770160FB7A93321867C7994ED3E7967B
                                                                                                                                                                                                                  SHA-512:EB253B548C7F574943136764A23818F9DEDEA17FF42F92DC8591F4B7C297ACCDDE9F6B2C0AD96F1FD0815C53940C0102A90C603F9F4D6D9C8FB053B559CC7A62
                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                  Preview:.........(..e.....h.....i.!...j.+...k.:...l.E...n.M...o.R...p._...q.e...r.q...s.....t.....v.....w.....y.?...z.m...|.....}................................................. .....!.....".....$.....3.....?.....M....._...........w.................P...................................T.....s...........\.......................g.......................C.....l.................a.................N................."............ ....H ....a ..... ....$!....X!....m!.....!....C"....."....."....0#.....#.....$.....$.....$.....$.....$.....%....W%.....%.....%.....%....(&....u&.....&.....&.....'....e'.....'.....'.....(...._(.....(.....(.....(....G)....q).....).....).....*....C*....S*.....*.....+....4+....H+.....+....@,.....,.....,.....,....G-....f-....|-.....-..........7.....[............/....K/....^/...../....O0.....0.....0....&1....i1.....1.....1.....2....x2.....2.....2....B3.....3.....3.....3....g4.....4....95....R5.....5....C6.....6.....6....&7.....7.....7.....7....*8....t8.....8.....8....,9.....9.....9

                                                                                                                                                                                                                  C:\Users\user\AppData\Local\Temp\nshFAEA.tmp\7z-out\locales\ru.pak

                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                  Process:C:\Users\user\Desktop\cMqyGFCQHk.exe
                                                                                                                                                                                                                  File Type:data
                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                  Size (bytes):996315
                                                                                                                                                                                                                  Entropy (8bit):4.845331047532895
                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                  SSDEEP:12288:4I6pfQjRo4YSWPAY+zJ9LF1WAati/16HzW/yqSvDsNL4kXew+YHVeXN2hVO3j/iH:4T25H3Oc
                                                                                                                                                                                                                  MD5:E9AF20A6226511CD535888846A2BB16F
                                                                                                                                                                                                                  SHA1:739A46269F334ECC291BAE6777F0B7C8E271E4C0
                                                                                                                                                                                                                  SHA-256:5DB640C6C288D9FC79012A7670301A3BC463359C17BA200AEDAA56260EF8D955
                                                                                                                                                                                                                  SHA-512:7897C500718382F08D55F3CDDD96D1451524B5C2B8FEBC65E1700A645598B622C819EC66E4A21C119F044FAAA525A2ABDDDF66D0C9800AF6ECEA9CEB217A88BB
                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                  Preview:.........(d.e.....h.....i.....j.....k.....l.....n.....o.....p.%...q.+...r.7...s.f...t.}...v.....w.....y.....z.3...|.Z...}...............................................................................$.....<.....c.....X.....$...............................................D.............................G...........0...........8.....[.................Q.....h...... ..... .....!....J!....=".....#.....#.....#....z$.....%...._%.....%....;&.....&.....'....A'.....'.....(....#)....P)....T*....N+.....+.....,.....,....0-....]-.....-............................_/...../...../.....0.....0.....1....X1....}1....#2.....2.....2...."3.....3....%4....`4....w4.....4....t5.....5.....5....B6.....6.....6.....7.....8.....8...._9.....9.....:.....:.....:.....:....T;.....;.....;.....;....|<.....=.....=.....=.....>.....?.....?.....?....|@.....@.....A.....A.....A....GB.....B.....B.....C.....C....mD.....D....jE...."F.....F.....F.....G.....H.....I....lI.....J.....J.....J.....J....xK.....K....&L....?L.....M.....M....4N

                                                                                                                                                                                                                  C:\Users\user\AppData\Local\Temp\nshFAEA.tmp\7z-out\locales\sk.pak

                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                  Process:C:\Users\user\Desktop\cMqyGFCQHk.exe
                                                                                                                                                                                                                  File Type:data
                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                  Size (bytes):626605
                                                                                                                                                                                                                  Entropy (8bit):5.815043408006658
                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                  SSDEEP:12288:6fKTvoktDh40i/igVQm5611wYZLtWTjsxt9Wl:6KTdjib5ewsPtIl
                                                                                                                                                                                                                  MD5:B0BBB6661370D27B6600EBE98CADB9AC
                                                                                                                                                                                                                  SHA1:1139852DA47048F15C16EB101DAC86DFC8F652BA
                                                                                                                                                                                                                  SHA-256:E0FE4130E668AC659D5334C5BC8CDE70BBA8742273B5965836860B5A8B1B016A
                                                                                                                                                                                                                  SHA-512:C8EAC323552F873EC088F77B8C46522387B0298B6D566CF8AA173FA9B2D66389068BB26E46044AF2FAA4224B39DC748164843B58B99E9DDE093FCB32AFB5FED0
                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                  Preview:.........(..e.....h.....i.....j.:...k.I...l.T...n.\...o.a...p.n...q.t...r.....s.....t.....v.....w.'...y.N...z.|...|.....}.....................................!.....(...../.....0.....1.....3.....G.....O.....a.....v.....2...........N.....l...........M.................'.........................................6.................4.....G.................).....=.................K.....p.............................z ..... ....,!....E!.....!....("....^"....o"....."....v#.....#.....#....d$.....$....B%....]%.....%.....&....3&....H&.....&.....'..../'....A'.....'.....(....)(....;(.....(.....)....Y)....o).....)....L*.....*.....*.....*....X+.....+.....+.....+....u,.....,.....,.....-.....-.....-.....-....s...........D/....\/...../...../.....0....+0.....0.....0.....0.....1.....1.....1.....2....#2.....2.... 3....e3.....3.....3....C4...._4....t4.....4....R5....y5.....5.....6.....6.....6.....6.....7.....8.....8.....8.....9.....9.....9.....9....O:.....:.....:.....:....L;.....;.....;.....;...._<.....<.....=

                                                                                                                                                                                                                  C:\Users\user\AppData\Local\Temp\nshFAEA.tmp\7z-out\locales\sl.pak

                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                  Process:C:\Users\user\Desktop\cMqyGFCQHk.exe
                                                                                                                                                                                                                  File Type:data
                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                  Size (bytes):601837
                                                                                                                                                                                                                  Entropy (8bit):5.489524001909229
                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                  SSDEEP:12288:mZ9VfcB2z/i1SE5vqfCWJU171i/fzSjqc:mHVBWSE5vqfmi/fzSl
                                                                                                                                                                                                                  MD5:AA7C0F35B61A230D65E498DAAB67388C
                                                                                                                                                                                                                  SHA1:F60CB1C7128A1FB1CFD9AA029F96DF36033777D0
                                                                                                                                                                                                                  SHA-256:03AFC83CDBA98C08AF169C8AE111AA916F3EE6D5A2FEE4954EF35ECC063F2B21
                                                                                                                                                                                                                  SHA-512:048D03C490F18D22F4900363F9C4ABEE037A2029F226C90806064FFEDC85B07A1D86225B9C534311B08F588632A84221D7E4FA355E7B768CFDFD6102C5FFE705
                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                  Preview:.........(..e.....h.....i.....j.....k."...l.-...n.5...o.:...p.G...q.M...r.Y...s.....t.....v.....w.....y.'...z.U...|.|...}...............................................................................,.....<.....O...........n.................J...................................N.....m...........9.....m.................8.....c.....p...........+.....V.....e...........G.....|........... .......................]............ ..... ..... ..... ....%!....9!.....!....3"....j"....."....$#.....#.....#.....$....v$.....$.....$.....$....T%.....%.....%.....%....?&.....&.....&.....&....K'.....'.....'.....(....n(.....(.....).....).....).....)....;*....P*.....*.....+....:+....M+.....+.....,....B,....Q,.....,....,-....i-.....-.....-....8.....X.....p............/....;/....V/...../.....0....\0....n0.....0....O1.....1.....1.....2....l2.....2.....2.....3....x3.....3.....3....34.....4.....4.....4.....5..../6.....6.....6....j7.....7....@8....}8.....8....T9.....9.....9.....9....;:....Y:....i:.....:....I;.....;

                                                                                                                                                                                                                  C:\Users\user\AppData\Local\Temp\nshFAEA.tmp\7z-out\locales\sr.pak

                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                  Process:C:\Users\user\Desktop\cMqyGFCQHk.exe
                                                                                                                                                                                                                  File Type:data
                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                  Size (bytes):924863
                                                                                                                                                                                                                  Entropy (8bit):4.7696519516761695
                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                  SSDEEP:12288:nP3ydDCzsexx7UinNLQIlApSld7vwFi4CBaAwH5YvTEquCxa4F37nyIzy/k/S:P3G2zBTfWt5suBr
                                                                                                                                                                                                                  MD5:ABDD9EB966D915C1896B31CBA0B2656B
                                                                                                                                                                                                                  SHA1:CB0080E5F2C168CD0F3EDC6ED6C47734FFD67790
                                                                                                                                                                                                                  SHA-256:3913D3BE5016CE873AC68AF376D5FCF558BB5F5F29A9BC56DF0099BA47E52486
                                                                                                                                                                                                                  SHA-512:BCB258D6DA766BB6F00DFDBB03BC878000D9CF28B2B707375CE52485DB9C530A34D1528A1473F09B5765BC57ABD847F191BDE55646EB707443CD0E40509B70E1
                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                  Preview:.........(..e. ...h.(...i.9...j.E...k.T...l._...n.g...o.l...p.y...q.....r.....s.....t.....v.....w.2...y.Y...z.....|.....}...............................%.....,.....3.....:.....;.....<.....>.....h................................... .....R.................#.....F.....A.............................M.......................) ....| ..... ....(!.....!.....!.....!....."....b#.....#.....#.....$.....%....=&.....&....C'.....'....B(....k(....').....).... *....E*....++.....+....b,.....,.....-....y....../....V/...../....V0.....0.....0....B1.....1.....1.....2.....2.....3....G3....f3....*4.....4....+5....V5.....5.....6.....6.....6.....7.....8....Q8....l8.....9.....9.....9.....9.....:.....;....n;.....;....[<.....=.....=.....=....E>.....>.....>.....?.....?....%@....^@.....@....EA.....A....$B....AB.....C.....C.....D....\D.....D....eE.....E.....E.....F.....G....lG.....G....xH.....H....yI.....I.....J....fK.....K.....L.....M.....M....!N....kN....%O.....O.....P....%P.....P.... Q....XQ....uQ....FR.....R....[S

                                                                                                                                                                                                                  C:\Users\user\AppData\Local\Temp\nshFAEA.tmp\7z-out\locales\sv.pak

                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                  Process:C:\Users\user\Desktop\cMqyGFCQHk.exe
                                                                                                                                                                                                                  File Type:data
                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                  Size (bytes):541025
                                                                                                                                                                                                                  Entropy (8bit):5.5401177610527155
                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                  SSDEEP:6144:MnZyPzw0uHrwiTR91Q0Z4IoogVChcxorsl6hI+vRFcz5RtGl2KYF4bkvMrOSOgfm:i8U7DTC0Z4KhJW5krMTMo
                                                                                                                                                                                                                  MD5:CC0806219798E3ADE0437219457A37AB
                                                                                                                                                                                                                  SHA1:DD6BA47E14B7B0D08159FBCA2409B013DC2E17DE
                                                                                                                                                                                                                  SHA-256:79A7260C8651FF3024E21F9263543BF4E9D5F3574E81CF96EDF6388F8DA85CD1
                                                                                                                                                                                                                  SHA-512:DF3DA02BB2FECBBAF1AB80AF8EF8B1A7AE9F6C7ED01F94C5A502720376924132C344DD716FC5B4DDC03733A6C3581ED8D8A577154C619BA85C527DC67F4A48C2
                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                  Preview:........p(..e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.8...t.O...v.....w.....y.....z.....|.,...}.]...........................................................................................................Y.....o...........B.........................................e.......................r.......................r...................................1.....Q...........?.......................].................. ....x ..... ..... ....E!.....!....."....#"....."....N#.....#.....#.....$....n$.....$.....$.....$....O%....t%.....%.....%....-&....S&....b&.....&....2'....i'....{'.....'....6(....d(....s(.....(....()....S)....b).....).....*....C*....S*.....*.....+....H+....W+.....+....*,....e,....z,.....,....%-....E-....^-.....-.....-..........1.....}.......................u/...../.....0....D0.....0.....0.....1....-1.....1.....1.....2....&2.....2.....2.....3....03.....3....44.....4.....4.....5.....5.....5.....5....W6.....6.....6.....6....F7.....7.....7.....7.....8.....8.....8

                                                                                                                                                                                                                  C:\Users\user\AppData\Local\Temp\nshFAEA.tmp\7z-out\locales\sw.pak

                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                  Process:C:\Users\user\Desktop\cMqyGFCQHk.exe
                                                                                                                                                                                                                  File Type:data
                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                  Size (bytes):570564
                                                                                                                                                                                                                  Entropy (8bit):5.341574755821131
                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                  SSDEEP:12288:Evzozr9Cpdjcu25KmedqrCBfRdpG5PbQW49qx2FRyl+Y4jNUkCarOg6jP5AuNskZ:Evk3v15zsI
                                                                                                                                                                                                                  MD5:A63EF2C4676DFBEE98E29A84A7AD9D27
                                                                                                                                                                                                                  SHA1:2F0F4B33ACF5E63F3159C62C74DEAA9A361203F4
                                                                                                                                                                                                                  SHA-256:7B8C51B247DEA72D68CB0EF4292800C13209DA6F859A9AD289C996582F19E65C
                                                                                                                                                                                                                  SHA-512:CD65FD2C49D35757DE648F21DEC748FB4A1D13D2308552774FE9C859AD5748B21F5DB449F8B380520F27DC868A3EBAAFD58D4C45ABA34033785777D342E17E6F
                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                  Preview:.........(..e.....h.....i.!...j.-...k.<...l.G...n.O...o.T...p.a...q.g...r.s...s.....t.....v.....w.....y.A...z.o...|.....}.................................................".....#.....$.....).....;.....K....._.....v.............................U...................................L.....b.................I.....].................2.....A.......................).................*.....P...........N.................%.......................3 ..... ..... ..... ....4!.....!.....!.....!....q"....."....J#....f#.....#.....$....8$....S$.....$.....$.....%.....%....Z%.....%.....%.....%....L&.....&.....'.....'....m'.....'.....'.....(....n(.....(.....).....)....l).....).....).....)....X*.....*.....*.....*....q+.....+....",....;,.....,.....,.....-....6-.....-.....-....).....J............/....F/....V/...../....20....{0.....0.....1....N1....o1.....1.....1....02....X2....j2.....2....F3.....3.....3....04.....4.....5.....5.....5.....5....>6....[6.....6....P7.....7.....7.....8....j8.....8.....8....89.....9.....9

                                                                                                                                                                                                                  C:\Users\user\AppData\Local\Temp\nshFAEA.tmp\7z-out\locales\ta.pak

                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                  Process:C:\Users\user\Desktop\cMqyGFCQHk.exe
                                                                                                                                                                                                                  File Type:data
                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                  Size (bytes):1468553
                                                                                                                                                                                                                  Entropy (8bit):4.052663401346278
                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                  SSDEEP:3072:eO7hLhGq5MLs32+5CrVKa1i55G62sRtRdutm1vYpiMy+:rdLhGoC+sBD1i554sRtRdutm1vYpiMy+
                                                                                                                                                                                                                  MD5:AA06EAD1200F01C9460399F0ABE2D54F
                                                                                                                                                                                                                  SHA1:9B852C4691209C0AE9EDF94A5DEC4B902FEC7B3E
                                                                                                                                                                                                                  SHA-256:1946D903918C57836D2F898EF93CD1D575DA1A464E358C399DFDE73EA2EF057E
                                                                                                                                                                                                                  SHA-512:6E556B962C16AEE22695D93B62B308D95B0695873FB33D13A147B3D8B6791C9599DAA6E3BF424A1897212A018AB36DD8C8214C2EB03457048C6931686BE40E04
                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                  Preview:........w(..e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.F...t.]...v.....w.....y.....z.....|.:...}.k.............................................................................).....i...........e...........G.....y.............................}...... .....!.....!....D#....z$.....%....H%....I&....<'.....'.....'.....(.....).....*..../*....g+....k,.....,....V-...........0.....0....21....S2....i3.....4....O4.....5.....6....[7.....7.....8....5:.....;....d;.....<.... >.....?....m?....p@....9A.....A.....A.....B.....C.....D....<D....$E.....E....ZF.....F.....G.....H....UI.....I.....J.....K.....L....<L....*M.....N.....N.....N.....O.....P.....Q....KQ....ER....6S.....S.....S....>U.....V....kW.....W.....X.....Y.....Z....CZ....&[.....[....J\.....\....p]....Y^....$_....q_.....`.....a....+b.....b.....c....Nd.....d.....d.....f...."g.....g.....h.....i.....j....tk.....k.....m.....o.....q....Pq.....r.....s....nt.....t....Nv....tw....$x.....x.....y....vz.....z....6{....h|.....}....5~

                                                                                                                                                                                                                  C:\Users\user\AppData\Local\Temp\nshFAEA.tmp\7z-out\locales\te.pak

                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                  Process:C:\Users\user\Desktop\cMqyGFCQHk.exe
                                                                                                                                                                                                                  File Type:data
                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                  Size (bytes):1359248
                                                                                                                                                                                                                  Entropy (8bit):4.307321925100967
                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                  SSDEEP:12288:RG0y8Y7McKNW0yR5D7FgpC8ybtKRT5sbvkW3p/8WffhBp3p1FPnzTitlF2iDk7Pi:RGB+s5RNHFy
                                                                                                                                                                                                                  MD5:A4ACCC25DD8A00BC57DF4FCA12E41295
                                                                                                                                                                                                                  SHA1:9466888034C9E6ECF4113DDDA63D363ED20E3156
                                                                                                                                                                                                                  SHA-256:157D646525F6A9AC267466631671E65E9B5C3E55B008B564186E64C6853E52AA
                                                                                                                                                                                                                  SHA-512:F19116655B6C2BB5C572B45F1D712FA1F9D57D9E8963FB3D654ED3781BD34A4E937B590BCC1119A318E28632DA12A0EF8B36F6426791DE833898CF7F30189567
                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                  Preview:.........(..e.:...h.B...i.\...j.h...k.w...l.....n.....o.....p.....q.....r.....s.....t.....v.)...w.U...y.|...z.....|.....}.......+.....0.....8.....@.....H.....O.....V.....].....^....._.....d.......................^.......................D.................".....q............ ..... ....6!....s".....#....+$....f$....H%.....%....D&....y&.....'....X(.....(.....)....'*.....*....l+.....+....O-....y.....E/...../.....0.....1....e2.....2.....3.....4....i5.....5.....7....C8....A9....~9.....:....d<....D=.....=.....>....:?.....?.....?.....@.....A.....B....]B....qC....6D.....D.....D....3F.....G.....G.....H....5I.....J.....J.....J.....K.....L....>M.....M.....N....nO.....O....%P....KQ.....R.....R.....R....8T.....U.....U.....V.....W.....W.....X....`X....+Y.....Y.....Y....,Z.....Z.....[....h\.....\.....].....^....._....#`....$a.....a....4b.....b.....c.....d....#e....pe.....f....sg.....h....Vh....(j.....k.....l....!m.....n.....o....op.....p....6r....#s.....s.....t.....u.....u....?v.....v.....w.....x.....y

                                                                                                                                                                                                                  C:\Users\user\AppData\Local\Temp\nshFAEA.tmp\7z-out\locales\th.pak

                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                  Process:C:\Users\user\Desktop\cMqyGFCQHk.exe
                                                                                                                                                                                                                  File Type:data
                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                  Size (bytes):1142703
                                                                                                                                                                                                                  Entropy (8bit):4.350453098899463
                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                  SSDEEP:12288:X6cnN9LyZYAPTKznL/4svUSynUGevuB5Uz0dNL3fRj8NRU+wunRUdGILV+w11LAn:X05ANf
                                                                                                                                                                                                                  MD5:B18E4574DB917920ECCFB8E6900D0662
                                                                                                                                                                                                                  SHA1:554206B9E639135074B0946FB28B6FFE2D934159
                                                                                                                                                                                                                  SHA-256:C14FA1BB30C880216D6CFEA6FB738235CF72A3FE8BE919C3D61321D5A5883211
                                                                                                                                                                                                                  SHA-512:5F427F9ED85BB368B45BAFD523C634E18596E430FDC380563878D2CA897CF2580D0405F7C0D8E10ABBA389BB7125978A81D335263BB777E0EE0BFE3D47C8C65F
                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                  Preview:.........'..e.8...h.@...i.H...j.S...k.b...l.h...o.p...p.}...q.....r.....s.....t.....v.....w.6...y.]...z.....|.....}.........................$.....,.....1.....9.....@.....G.....N.....P.....U.....y.................<.....M.....$.......................`.............................h.......................]...........P............ ....> ..... ....Z!.....!.....!.....".....#.....$.....$....y%.....&.....&.....&.....'....R(.....(.....(.....)....f*.....*.....*.....+....t,.....,.....-....F.....5/...../....30.....1.....1.....1....82.....3.....3.....4....@4.....5.....5.....5.....6.....6.....7.....8....A8.....9.....9....4:....X:....$;.....;....E<....l<.....=.....=.....>..../>.....?.....?....%@....L@....fA....cB....'C....OC.....D.....D.....D.....E.....E....JF.....F.....F....hG.....G....OH.....H.....I....TJ.....J....ZK.....K....oL.....L.....L.....M....<N.....N.....N.....O....KP.....P.....Q.....R.....R.....S.....S.....U.....V.....V....$W.....X.....X....HY....xY.....Z.....Z....![....@[....I\.....].....]

                                                                                                                                                                                                                  C:\Users\user\AppData\Local\Temp\nshFAEA.tmp\7z-out\locales\tr.pak

                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                  Process:C:\Users\user\Desktop\cMqyGFCQHk.exe
                                                                                                                                                                                                                  File Type:data
                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                  Size (bytes):581275
                                                                                                                                                                                                                  Entropy (8bit):5.614415854351588
                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                  SSDEEP:12288:A9dM9N/9/UHzNsgkDQqZFtQSJ8kJ5MLJy:0eZb8kJ50Jy
                                                                                                                                                                                                                  MD5:82C6A14BA1B28F947BEE67BC3FEAB091
                                                                                                                                                                                                                  SHA1:25023B22EAED29D0817EC95D5BCB4AD3D724F5AD
                                                                                                                                                                                                                  SHA-256:099507F6F2A2C98ECCE275F8AD956EEEEAADA65B7788356301AF04A0CD7D431E
                                                                                                                                                                                                                  SHA-512:988A9275B7A05D100CA9242DD05969D2363A42938D47DB37A1F62EC1874E96B640C14B272F1829AB5C6E0D2763C22FBF0AF99894D4D9D32726925EABBC02C05E
                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                  Preview:.........(..e.~...h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.-...v.b...w.....y.....z.....|.....}.;.....d.....i.....q.....y...................................................................................k.................K................. .......................Y.......................].......................D.......................N...................................3.....P............ ....G ....X ..... .....!....6!....F!.....!....2"....u".....".....#.....#.....#.....#....D$.....$.....$.....$....D%.....%.....%.....%....A&.....&.....&.....&....A'.....'.....'.....'....T(.....(.....(.....)....b).....).....).....*...._*.....*.....*.....*....\+.....+.....+.....+.....,.....-....R-....k-.....-....1.....^.....z...........$/....F/....a/...../.....0....C0....U0.....0....,1....f1.....1.....1....52....T2....d2.....2....(3....S3....h3.....3....<4.....4.....4....C5.....5....[6....m6.....6....r7.....7.....7....o8.....8....)9....E9.....9.....:....9:....N:.....:....';....`;

                                                                                                                                                                                                                  C:\Users\user\AppData\Local\Temp\nshFAEA.tmp\7z-out\locales\uk.pak

                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                  Process:C:\Users\user\Desktop\cMqyGFCQHk.exe
                                                                                                                                                                                                                  File Type:data
                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                  Size (bytes):996487
                                                                                                                                                                                                                  Entropy (8bit):4.873979205850633
                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                  SSDEEP:12288:1x/vKIH9mGGHWK9TddsSr+whF5gZrZEdIIXgOb5YB3Ijwl2Ab+rUcauHLNiXErqx:3/vXH9ynh5BrI
                                                                                                                                                                                                                  MD5:EC3AA18A9D9C989B1025DDDB0FA52B55
                                                                                                                                                                                                                  SHA1:AB3B0834CABEE34BC2F9FD04104B10E5F9C102CA
                                                                                                                                                                                                                  SHA-256:EE67744C26E0C69FBED8B102ADD339070AABC70C2D8CA9EA037C6C9D23B66D3B
                                                                                                                                                                                                                  SHA-512:90D40424B050C6C7ACE113E85B0B0A58472967C50A14FBC6637CD3B2DB8FF3F521CC94DCD256FA017684256E8A9C19B158AAA57F6D3094FAB970578D3B1C6847
                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                  Preview:........[(..e.t...h.|...i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.%...v.Z...w.....y.....z.....|.....}.3.....\.....a.....i.....q.....y...........................................................7....."...........x...........\...........b...........W.............................&.................q...........X.....}...... ..... .....!.....!.....!....f".....".....".....#.....$....'%....c%.....&.....&.....'....5'.....'....t(.....(.....(.....)....a*.....*.....*.....+.....,....8-....r-..........k.................\/...../.....0....90.....0....81....v1.....1....H2.....2....F3....m3.....4.....4.....4.....4.....5.....6....R6....k6.....6....z7.....7.....7....n8.....8....<9....W9....P:.... ;.....;.....;....}<.....<....A=....c=.....=....9>....b>.....>....5?.....?....T@....o@....dA.....B.....B.....C.....C.....D....<D....iD.....E.....E.....E.....F.....F....]G.....G.....H.....H.....I....hJ.....J....wK....;L.....L.....M.....M....DN.....N.....N....EO.....O.....P.....P.....P.....Q.....R

                                                                                                                                                                                                                  C:\Users\user\AppData\Local\Temp\nshFAEA.tmp\7z-out\locales\ur.pak

                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                  Process:C:\Users\user\Desktop\cMqyGFCQHk.exe
                                                                                                                                                                                                                  File Type:data
                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                  Size (bytes):870809
                                                                                                                                                                                                                  Entropy (8bit):5.161712117251234
                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                  SSDEEP:12288:wtiyilnG/Uo458PMzCR4FXdQLN9AyTibR45GO6EhTCWORJlbQYrMYVwadcJKwURn:Vyie5T5/Cgu
                                                                                                                                                                                                                  MD5:CB228CC41981E8BCBD2768DA20026912
                                                                                                                                                                                                                  SHA1:C55BB999C4C1FBEE5E38B6C986FBCE2B128F3880
                                                                                                                                                                                                                  SHA-256:A7D825FE348700528800EF9EA7940EE8027373E9C05A4E51E526D0A213C05429
                                                                                                                                                                                                                  SHA-512:85308806BE53494683F32520E181DD9C8C9ABAC0B92BC439D4E30EEF22D4AF993794A9719DD9A4EEED0BBCAF61C0E2342E7D4ED5D30B504572BD2BC269100E2E
                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                  Preview:.........(..e.....h.....i.....j.....k.!...l.,...n.4...o.9...p.F...q.L...r.X...s.....t.....v.....w.....y.&...z.T...|.{...}.........................................................................&.....@.....^...........Z.......................w.....!.......................G.......................N.................k...........7.....X...........g ..... ..... ....d!.....!....%"....R".....#.....#.....$....Q$.....$.....%.....%.....&.....&....L'.....'.....'.....(....W).....).....*.....*.....+....7,....h,.....,....H-.....-.....-....+.......................q/...../.....0....90.....0....Z1.....1.....1....a2.....2....A3...._3.....3....j4.....4.....4....U5.....5.....6....)6.....6....47.....7.....7....d8.....9.....9.....9....Q:.....:.....;....=;.....;.....<....K<....y<.....=.....=.....=.....=.....>....@?.....?.....?....x@.....@....%A....HA.....A.....B.....B.....B.....C....GD.....D.....D.....E....xF.....F....!G.....H.....H....-I....lI....7J.....J....4K....bK.....K....qL.....L.....L.....M.....N....oN

                                                                                                                                                                                                                  C:\Users\user\AppData\Local\Temp\nshFAEA.tmp\7z-out\locales\vi.pak

                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                  Process:C:\Users\user\Desktop\cMqyGFCQHk.exe
                                                                                                                                                                                                                  File Type:data
                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                  Size (bytes):689415
                                                                                                                                                                                                                  Entropy (8bit):5.7905904014606335
                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                  SSDEEP:12288:v8/9MO+cGZoEK9VaZLlFK0FgxBxJbTsIxvx5a8h/9cDNUOnmzi0HRva8Z1lc:vSSO+cG6V4lE0uxHZH5a899yiOnwi01k
                                                                                                                                                                                                                  MD5:045241A62232BAE57F1D57C6C3AF7C55
                                                                                                                                                                                                                  SHA1:5C2A1A677A8BDFA20F3577335131BD4B89A46355
                                                                                                                                                                                                                  SHA-256:56758C918BBFE6A9D5B20E8B4A7248BDF2D43E0BF5F98E85A9892FF03DBC2D99
                                                                                                                                                                                                                  SHA-512:8E30AF44A53A36A194DA16A756DFF0F90EFBEF164277BDCDE683C89A3CDC04AE5E1298475E8A098D19DAB73EB0A71637F676D49D237C5480E1F7ACA1765166BB
                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                  Preview:........P(..e.^...h.f...i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.M...w.y...y.....z.....|.....}.&.....O.....T.....\.....d.....l.....s.....z...........................................................O.................r...........G.....^.......................*...........+.....}.................?.....e.....q...........G.................2.............................. .....!.....!.....!....?"....."....."..../#.....#.....#.....$.....$....;%.....%.....%....t&.....'....q'.....'.....(....o(.....(.....(....').....).....).....)....B*.....*.....*.....*.....+.....+....E,....\,.....,....2-....i-....z-.....-....D.....x.................Q/...../...../.....0....v0.....0.....0....r1.....2....x2.....2.....3.....3.....3.....3....V4.....4.....4...._5.....5.....6....+6.....6....h7.....7.....8.....8.....9....89....Z9.....9....W:.....:.....:....N;.....;.....<....+<.....<....s=.....=.....=.....>....Y?.....?.....?....u@.....@.....A....,A.....A.....A....2B....FB.....B....xC.....C.....C

                                                                                                                                                                                                                  C:\Users\user\AppData\Local\Temp\nshFAEA.tmp\7z-out\locales\zh-CN.pak

                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                  Process:C:\Users\user\Desktop\cMqyGFCQHk.exe
                                                                                                                                                                                                                  File Type:data
                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                  Size (bytes):496499
                                                                                                                                                                                                                  Entropy (8bit):6.685741162993645
                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                  SSDEEP:6144:rr0PPN0s9IHFKwowzwAEM7i56Ez2bHy1t59Lo3/4oT2Paq8lc:XGNXUKwTzwx956Ez2bH05Nov4oTUV
                                                                                                                                                                                                                  MD5:798BC7D8B63906C5B1C67E89AD17DC58
                                                                                                                                                                                                                  SHA1:B39C86D6D3FD9D8B8DA90D86F827A0C0803FBA8C
                                                                                                                                                                                                                  SHA-256:1C05280D8DCDFE99619695B76DD054292A90C1A93A5CFB92CDC4A5B0068A7092
                                                                                                                                                                                                                  SHA-512:7A21AF438823D562B889D7C99F639421E01F0536E95F3206DD53D2C8DED82B7A4AB74BB9B4262B2FA27E50EFD8DD7719827AD2E6B6D4C2E0D0811930027ED982
                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                  Preview:.........(U.e.....h.....i.....j.....k.+...l.2...m.:...o.a...p.f...q.l...r.x...s.....t.....v.....w.....|.F...}.w.........................................................................................%...........6.......................U.......................\.......................e.......................d......................./.....V.....c.................6.....P...........+.....l.....~...........:.....n.....{........... .....I.....U.................;.....M..........." ....` ....r ..... .....!.....!....5!.....!.....!.....!.....!....D"....."....."....."....!#.....#.....#.....#....)$....{$.....$.....$.....%....a%.....%.....%.....%....?&....g&....s&.....&.....'....A'....M'.....'....3(....t(.....(.....(....#)....C)....W).....).....)....$*....;*.....*.....*.....+....(+.....+.....+.....,....),....u,.....,.....,.....,....E-.....-.....-.....-....E.......................a/...../.....0....,0.....0.....0....01....E1.....1.....1.....2....*2....v2.....2.....2.....2....H3.....3.....3.....3....D4

                                                                                                                                                                                                                  C:\Users\user\AppData\Local\Temp\nshFAEA.tmp\7z-out\locales\zh-TW.pak

                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                  Process:C:\Users\user\Desktop\cMqyGFCQHk.exe
                                                                                                                                                                                                                  File Type:data
                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                  Size (bytes):491017
                                                                                                                                                                                                                  Entropy (8bit):6.696102855635661
                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                  SSDEEP:6144:IpP3caOCTyemy5JPFW2uHu4u0JU52UznMi4LnKeze9Tk:qXvmOWzu0JU52UznUeC
                                                                                                                                                                                                                  MD5:0BE25A48EECEE48F428FE56FBFA683FD
                                                                                                                                                                                                                  SHA1:94C0E8C99BEB592EBAB9EA5B8758AA414BBE7048
                                                                                                                                                                                                                  SHA-256:A5E276BDFE4CF87832EEE153596CCDE9CF9193E81F29A4295C8335525DA64295
                                                                                                                                                                                                                  SHA-512:423033E67654820AB9F9773F45F70908511AEB8228C59126757885E0BBE0BD960257324D405D27526D61B541B1E6323DE16BEF29D4DCB94F39FD5E92FA811CC8
                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                  Preview:.........'..e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.&...v.[...w.....y.....z.....|.....}.4.....].....b.....j.....r.....y.....................................................8.......................T.......................@.......................<.......................$.....y.......................J.....k.....x...........(.....N.....h...........%.....T.....i.................J.....W.................(.....4................./.....A.................W.....i.................. ..... ....g ..... ..... ..... ..../!....~!.....!.....!....."....X"....."....."....."....5#....^#....j#.....#.....$....M$....Y$.....$.....$....'%....0%.....%.....%.....&.....&....t&.....&.....'.....'....j'.....'.....'.....'....0(....v(.....(.....(....J)....t).....).....)....3*....d*.....*.....*.....+....!+....-+.....+.....+.....+.....,....s,.....,.....,.....-....|-.....-....=.....L............/....S/....h/...../.....0....G0....S0.....0.....0.....0.....0....M1.....1.....1.....1....=2.....2

                                                                                                                                                                                                                  C:\Users\user\AppData\Local\Temp\nshFAEA.tmp\7z-out\resources.pak

                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                  Process:C:\Users\user\Desktop\cMqyGFCQHk.exe
                                                                                                                                                                                                                  File Type:data
                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                  Size (bytes):5755390
                                                                                                                                                                                                                  Entropy (8bit):7.996220000544904
                                                                                                                                                                                                                  Encrypted:true
                                                                                                                                                                                                                  SSDEEP:98304:JZ5ti6+nkrht455GGPeenn0mJSwLEpxIvMi8rwrGU3nAaqdkmYAzFKwR4:j7ilnkrP455GGHnhEXU8kr1Xqdf1FvG
                                                                                                                                                                                                                  MD5:6772B597BF68622D934F207570E771B1
                                                                                                                                                                                                                  SHA1:F2A80FBFA034CB1FA07DC9AA37BF9F5B2280FF13
                                                                                                                                                                                                                  SHA-256:268DE4D99AB7C4F4EE32C8E8CB2B058A2C8D0D839F468AE8E8C0605FEAA736EA
                                                                                                                                                                                                                  SHA-512:A2BE67DF09951C9EF9200DCCCBDFF13736921522191F0001DA539D5C7F26B5B26A6B810BE6963908F216768C98D21E52486C7E00538CC0730E8C78E78811B85B
                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                  Preview:............f..#..{.V...|.*1..~..4....OG....aI................V...........@..............................................D9....Dc....D.....D.....D.....D.....D,....D" ...D*$...D.$..HE.$..IE.(..JEx*..SE-/..TE.8..UE.G..VE.h..\E.q..]E.r..^E.s..`E*t..aEty..bE....cExo..dE.Z..eE.[...E.\...E.m...Eho...Exs...E.u...E.{...E.....E....E.....E.....E[....E....EV....E.....E.....E7....E.....E.....E2....E.....L9....L.....L.....L+....LP....L.....L(.../Lo...0L5...1L,)..2L.3...Q.D...Q.P...QdY...Q.\...Q._...Q.j...Q.k...Q.l...QAn...Q.....Q.....R.....R....ZdA&..[d"(..\d:=..]d.@..^dpA.._d3D..`d.G..adqI...d.T...d.Y...d._...d.m...d.p...dUu...d.v...d.x...d.y...d.|...d;....d....6eL...7e|...8e...9e5...:e....;e....<e....=e....>e#...?e....@eo...Ae....Be=...Cex....gp....ga0...g.2.....3.....6.....*....X+.....2.....2.....4.....9.....L....K...........a.....g.....9.....Y.................7... .>...<..L..=..M..>..S..?..X..@.cZ..B.]g..C..i..D..s..E..v..F..w..G.i...H.....I.....J.....K.]...L.....M.....N.S...O._...P.L...Q...

                                                                                                                                                                                                                  C:\Users\user\AppData\Local\Temp\nshFAEA.tmp\7z-out\resources\app.asar

                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                  Process:C:\Users\user\Desktop\cMqyGFCQHk.exe
                                                                                                                                                                                                                  File Type:data
                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                  Size (bytes):11930143
                                                                                                                                                                                                                  Entropy (8bit):6.847204824927118
                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                  SSDEEP:98304:TM8gj5wrFTmZ1pGGzpEQTEbFSTc99qkx/vAb2cWd:Tq5wrFTmZ1pGGzpEQyYcntIb2cs
                                                                                                                                                                                                                  MD5:2D2E634D2A3D9593D69E3D39907DD40C
                                                                                                                                                                                                                  SHA1:4D27F0B39E971AC76C4103720227FF84BA64A443
                                                                                                                                                                                                                  SHA-256:6442B92CA87F0B448495AB5167129DEEEB8AD644F2E5B9CCF37EB0C637274852
                                                                                                                                                                                                                  SHA-512:BFC720E39FDC060971B51F0B1D57C1A2A119432A2D3DD65E6457C9BF67EDCD3E7597D3FC53CEC2A9DCA7D883DF3791D80EEB2850E494F8AEEE1AB108DD0C7573
                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                  Preview:....P...L...G...{"files":{"node_modules":{"files":{"@babel":{"files":{"generator":{"files":{"LICENSE":{"size":1106,"integrity":{"algorithm":"SHA256","hash":"117da2af0d4ce0fe1c8e19b5cff9dcd806adf973d328d27b11d4448c4ff24f76","blockSize":4194304,"blocks":["117da2af0d4ce0fe1c8e19b5cff9dcd806adf973d328d27b11d4448c4ff24f76"]},"offset":"0"},"lib":{"files":{"buffer.js":{"size":5771,"integrity":{"algorithm":"SHA256","hash":"49d70448373ee7293d57c661383f44e86174059be60d2f8fb98969ae97f16e5e","blockSize":4194304,"blocks":["49d70448373ee7293d57c661383f44e86174059be60d2f8fb98969ae97f16e5e"]},"offset":"1106"},"generators":{"files":{"base.js":{"size":2294,"integrity":{"algorithm":"SHA256","hash":"fb4891bbcaf0f27846b193500bc944213e7cbf2c0feb282795b153d70282e000","blockSize":4194304,"blocks":["fb4891bbcaf0f27846b193500bc944213e7cbf2c0feb282795b153d70282e000"]},"offset":"6877"},"classes.js":{"size":4157,"integrity":{"algorithm":"SHA256","hash":"7f9a3208c888e8ef986bf7cb79a5143fd8bb51308ca17bad9e0a5be0c5251

                                                                                                                                                                                                                  C:\Users\user\AppData\Local\Temp\nshFAEA.tmp\7z-out\resources\app.asar.unpacked\node_modules\ps-list\index.js

                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                  Process:C:\Users\user\Desktop\cMqyGFCQHk.exe
                                                                                                                                                                                                                  File Type:Java source, ASCII text
                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                  Size (bytes):4000
                                                                                                                                                                                                                  Entropy (8bit):5.348928984866719
                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                  SSDEEP:96:umC8wdGAK449W7zAaTkSZPXRS/hLfFBZ8tAemaPe6QaiiFVlPXRYaPJyPXCRy04:93/Gbk4BS5fFL82emJaii/hBLPkXCRyR
                                                                                                                                                                                                                  MD5:884E837BDA065828A42D633F81CDFAD5
                                                                                                                                                                                                                  SHA1:C1768675091EA6139B90E53853420CCEF9C09A4C
                                                                                                                                                                                                                  SHA-256:B7AC5FA0D24DF44755481B9876850FED593423D68C48EED9D30E989879B1864B
                                                                                                                                                                                                                  SHA-512:A43BD95B227BA0158A0005A9BFEC6DFDD3AD1CD85BCFBAF37681A7664B4D66E834BDD33484251374F791B5A5D7CBE2DC5CB26BAF0E029712F8977CB5509B9852
                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                  Preview:import process from 'node:process';.import {promisify} from 'node:util';.import path from 'node:path';.import {fileURLToPath} from 'node:url';.import childProcess from 'node:child_process';..const __dirname = path.dirname(fileURLToPath(import.meta.url));..const TEN_MEGABYTES = 1000 * 1000 * 10;.const execFile = promisify(childProcess.execFile);..const windows = async () => {..// Source: https://github.com/MarkTiedemann/fastlist..let binary;..switch (process.arch) {...case 'x64':....binary = 'fastlist-0.3.0-x64.exe';....break;...case 'ia32':....binary = 'fastlist-0.3.0-x86.exe';....break;...default:....throw new Error(`Unsupported architecture: ${process.arch}`);..}...const binaryPath = path.join(__dirname, 'vendor', binary);..const {stdout} = await execFile(binaryPath, {...maxBuffer: TEN_MEGABYTES,...windowsHide: true,..});...return stdout....trim()....split('\r\n')....map(line => line.split('\t'))....map(([pid, ppid, name]) => ({....pid: Number.parseInt(pid, 10),....ppid: Number.parse

                                                                                                                                                                                                                  C:\Users\user\AppData\Local\Temp\nshFAEA.tmp\7z-out\resources\app.asar.unpacked\node_modules\ps-list\license

                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                  Process:C:\Users\user\Desktop\cMqyGFCQHk.exe
                                                                                                                                                                                                                  File Type:ASCII text, with very long lines (460)
                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                  Size (bytes):1117
                                                                                                                                                                                                                  Entropy (8bit):5.079903213409815
                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                  SSDEEP:24:FHr4JHBH0yPP3gtAHw1hl9QHcsUv48Ok4/+dbo3oqxFD:FH8JplPvEDvQHcs5ITc3omFD
                                                                                                                                                                                                                  MD5:D5F2A6DD0192DCC7C833E50BB9017337
                                                                                                                                                                                                                  SHA1:80674912E3033BE358331910BA27D5812369C2FC
                                                                                                                                                                                                                  SHA-256:5C932D88256B4AB958F64A856FA48E8BD1F55BC1D96B8149C65689E0C61789D3
                                                                                                                                                                                                                  SHA-512:D1F336FF272BC6B96DC9A04A7D0EF8F02936DD594F514060340478EE575FE01D55FC7A174DF5814A4FAF72C8462B012998ECA7BB898E3F9A3E87205FB9135AF2
                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                  Preview:MIT License..Copyright (c) Sindre Sorhus <sindresorhus@gmail.com> (https://sindresorhus.com)..Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:..The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT

                                                                                                                                                                                                                  C:\Users\user\AppData\Local\Temp\nshFAEA.tmp\7z-out\resources\app.asar.unpacked\node_modules\ps-list\package.json

                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                  Process:C:\Users\user\Desktop\cMqyGFCQHk.exe
                                                                                                                                                                                                                  File Type:JSON data
                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                  Size (bytes):606
                                                                                                                                                                                                                  Entropy (8bit):4.677493590111802
                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                  SSDEEP:12:/r1JPknYwUj+T4SHtGwwnH/h6lGP9pek/GacG1GOcIretJYM+ROA:z1JmUrS0JH/hRrsOreJA
                                                                                                                                                                                                                  MD5:0D66A224C9A1C343842B7C97E5634EA6
                                                                                                                                                                                                                  SHA1:83E8A14CFACEB5A522E91F057CB76FA98162F9A7
                                                                                                                                                                                                                  SHA-256:B7A7AF79AE2225F7DEE5B160559468EFC4663CF8DFD2C6E9A068969CB089B003
                                                                                                                                                                                                                  SHA-512:E071F659C7C433B55F0F1AED83AE63032618E522D11077DA83E32D9ED072A20B123CB8083129DF7201DD19BCB1D578D87EF256659B74D9E82A0934B725957F38
                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                  Preview:{. "name": "ps-list",. "version": "8.1.1",. "description": "Get running processes",. "license": "MIT",. "repository": "sindresorhus/ps-list",. "funding": "https://github.com/sponsors/sindresorhus",. "author": {. "name": "Sindre Sorhus",. "email": "sindresorhus@gmail.com",. "url": "https://sindresorhus.com". },. "type": "module",. "exports": "./index.js",. "users": {. "node": "^12.20.0 || ^14.13.1 || >=16.0.0". },. "files": [. "index.js",. "index.d.ts",. "vendor/*.exe". ],. "devDependencies": {. "ava": "^3.15.0",. "tsd": "^0.18.0",. "xo": "^0.46.4". }.}

                                                                                                                                                                                                                  C:\Users\user\AppData\Local\Temp\nshFAEA.tmp\7z-out\resources\app.asar.unpacked\node_modules\ps-list\vendor\fastlist-0.3.0-x64.exe

                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                  Process:C:\Users\user\Desktop\cMqyGFCQHk.exe
                                                                                                                                                                                                                  File Type:PE32+ executable (console) x86-64, for MS Windows
                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                  Size (bytes):271872
                                                                                                                                                                                                                  Entropy (8bit):6.267941112452071
                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                  SSDEEP:6144:JxxmnATc41sT3iVSd87fqCHeohyRDaFsIh:3xmnz41s+VSsfT+o
                                                                                                                                                                                                                  MD5:F92F454DE8ECEDD3945DBAEACD381DC3
                                                                                                                                                                                                                  SHA1:ED4AA49E15795AC31F1E7CFAEF2E0C16359C5258
                                                                                                                                                                                                                  SHA-256:D1A71F9AC1728082C1B276392725C3E010B98714888579B99152E401ABEDBF11
                                                                                                                                                                                                                  SHA-512:312D62DA1F41E2B9FE0F15EF30D81A4241F309D83A24643EC8CB99104EF5EF7F52EC216C5CDF0E3995FC5B538DFDFC54E78FBDE3A57EB0AB8BD04DEC07CB5586
                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                  Antivirus:
                                                                                                                                                                                                                  • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......h...,.n.,.n.,.n.w.m.&.n.w.j.>.n.w.k..n...j.<.n...m.&.n...k.}.n.w.o.).n.,.o.L.n..g.-.n....-.n..l.-.n.Rich,.n.........................PE..d......^..........".................D..........@..........................................`.....................................................(....`....... ...#...........p..,.......p..............................0............................................text...\........................... ..`.rdata...I.......J..................@..@.data....*..........................@....pdata...#... ...$..................@..@_RDATA.......P......................@..@.rsrc........`......................@..@.reloc..,....p......................@..B................................................................................................................................................................................................

                                                                                                                                                                                                                  C:\Users\user\AppData\Local\Temp\nshFAEA.tmp\7z-out\resources\app.asar.unpacked\node_modules\ps-list\vendor\fastlist-0.3.0-x86.exe

                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                  Process:C:\Users\user\Desktop\cMqyGFCQHk.exe
                                                                                                                                                                                                                  File Type:PE32 executable (console) Intel 80386, for MS Windows
                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                  Size (bytes):215040
                                                                                                                                                                                                                  Entropy (8bit):6.5588154485327355
                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                  SSDEEP:6144:MuP738wut5T2/efnO310+Hfd+ueCuMvMLAOgp+HQ:MuPL8wut5T2/eCHF+ueCQeQHQ
                                                                                                                                                                                                                  MD5:3DE9EE7FE8CF4710DA1C8538A1BD86DF
                                                                                                                                                                                                                  SHA1:6FF4B813AD66F0B013222FE044579511A79804D8
                                                                                                                                                                                                                  SHA-256:017411F3B0B5C0402CC3B2CB87C32C6FC71ABD82E5B17EA6108990096C75A65D
                                                                                                                                                                                                                  SHA-512:0AAB4D484DF289485BEB90EE8B7D929D2D6FA5D7E4385C17B2745DEA40E295F1A9C6C3C8C6C206B46F04A50B51EB01952793FFB84E978C9D0D7447435280ABE7
                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                  Antivirus:
                                                                                                                                                                                                                  • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........HY..)7..)7..)7.A4..)7.A2.Z)7.A3..)7.4F3..)7.4F4..)7.4F2.)7.A6..)7..)6.)7.yY>..)7.yY...)7.yY5..)7.Rich.)7.................PE..L......^.................$.........."z.......@....@.......................................@.................................L$..(....P.......................`... ......p...........................P...@............@..@............................text....".......$.................. ..`.rdata.......@.......(..............@..@.data........0......................@....rsrc........P.......$..............@..@.reloc... ...`..."...&..............@..B........................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                  C:\Users\user\AppData\Local\Temp\nshFAEA.tmp\7z-out\resources\elevate.exe

                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                  Process:C:\Users\user\Desktop\cMqyGFCQHk.exe
                                                                                                                                                                                                                  File Type:PE32 executable (console) Intel 80386, for MS Windows
                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                  Size (bytes):107520
                                                                                                                                                                                                                  Entropy (8bit):6.442687067441468
                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                  SSDEEP:3072:1bLnrwQoRDtdMMgSXiFJWcIgUVCfRjV/GrWl:1PrwRhte1XsE1l
                                                                                                                                                                                                                  MD5:792B92C8AD13C46F27C7CED0810694DF
                                                                                                                                                                                                                  SHA1:D8D449B92DE20A57DF722DF46435BA4553ECC802
                                                                                                                                                                                                                  SHA-256:9B1FBF0C11C520AE714AF8AA9AF12CFD48503EEDECD7398D8992EE94D1B4DC37
                                                                                                                                                                                                                  SHA-512:6C247254DC18ED81213A978CCE2E321D6692848C64307097D2C43432A42F4F4F6D3CF22FB92610DFA8B7B16A5F1D94E9017CF64F88F2D08E79C0FE71A9121E40
                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                  Antivirus:
                                                                                                                                                                                                                  • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......B..O..............h.......j.q.....k.....e......e......e.......zR........._...h......h.f.............h......Rich....................PE..L......W............................l........0....@.......................................@....................................P.......x.......................T.......p...............................@............0..$............................text............................... ..`.rdata...k...0...l..................@..@.data...............................@....gfids..............................@..@.rsrc...x...........................@..@.reloc..T...........................@..B........................................................................................................................................................................................................................................................

                                                                                                                                                                                                                  C:\Users\user\AppData\Local\Temp\nshFAEA.tmp\7z-out\snapshot_blob.bin

                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                  Process:C:\Users\user\Desktop\cMqyGFCQHk.exe
                                                                                                                                                                                                                  File Type:data
                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                  Size (bytes):316538
                                                                                                                                                                                                                  Entropy (8bit):4.177181507694743
                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                  SSDEEP:3072:p+JfFRciefJNlUMX2kIE1aOaVsS/3hYeFWYSITdJgClE+ceNTbM:pefPciePmMXh1aOCsy3hpFRlzVw
                                                                                                                                                                                                                  MD5:C8950B01F336B05609976546B1A007E6
                                                                                                                                                                                                                  SHA1:F04D0B0369007BBE6A7FE129B31B19DD1822F32F
                                                                                                                                                                                                                  SHA-256:9B3A75A713E41BC73F219858FCAC8E3031BA22732285ED3A64DC48074C725CC2
                                                                                                                                                                                                                  SHA-512:B7DB4277290E849A52AD5D31FF65AB5D2B75C2125D67EEEE02B09E4E7001AA46D10BF89429C65695C7560D1C45B898C20275EB9E36CD8B259707FFB8B298F103
                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                  Preview:..........(.._.13.0.245.16-electron.0..........................................`L..............l....K..}.a........a........a2.......aj.......ad.......a<....................r........2.............R..............r........2...(Jb...-Q.....@...^.M..Q.`.....(Jb...1U.....@...^..`.....H...IDa........Db............D`.....I.D`......]D....Da..........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa............L.....................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                  C:\Users\user\AppData\Local\Temp\nshFAEA.tmp\7z-out\v8_context_snapshot.bin

                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                  Process:C:\Users\user\Desktop\cMqyGFCQHk.exe
                                                                                                                                                                                                                  File Type:data
                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                  Size (bytes):687473
                                                                                                                                                                                                                  Entropy (8bit):5.155441647860749
                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                  SSDEEP:6144:vPYRCOn2E6keR1PciePmMXh1aOCsy3hbHRlEDMrVkSiF01gwoHZHCvqmO9iXz8pk:vPY5nnbe3WZBr/iXo73nVE+2l
                                                                                                                                                                                                                  MD5:BF2976DA5086B48D74EB36F56F5DEB83
                                                                                                                                                                                                                  SHA1:5AA7669A3E2166FDD7534241A0E7A9BD3FF5748B
                                                                                                                                                                                                                  SHA-256:9F1614328E18BECB4ADF96DE98BC91CE2A69274ABE6621327CC0FC8503A1AB20
                                                                                                                                                                                                                  SHA-512:C44DEEB96597B4498604ECF2060EE0520E84A00308CA1F47FFDF8E3ED3E676B27B622FF7DBD4B6F1A14CE60B05CC2AD9B8D7562BB362C1B12A885EA7FBE50E0A
                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                  Preview:...........a.na.13.0.245.16-electron.0..............................................!...i...1...q.......l...x...}.a........a........a........aj.......ad.......a<....................r........2.............R..............r........2...(Jb...-Q.....@...^.M..Q.`.....(Jb...1U.....@...^..`.....H...IDa........Db............D`.....I.D`......]D....Da..........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa............L.............................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                  C:\Users\user\AppData\Local\Temp\nshFAEA.tmp\7z-out\vk_swiftshader.dll

                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                  Process:C:\Users\user\Desktop\cMqyGFCQHk.exe
                                                                                                                                                                                                                  File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                  Size (bytes):5533184
                                                                                                                                                                                                                  Entropy (8bit):6.341413194477468
                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                  SSDEEP:49152:zBVtMrKyOsxYYAKDsJS86IxORjgUlC3K/FAz4gdm6o4oX7uh5LC6MW4LY67h772c:jWKyOEnOnoLrWbfDiN9isC
                                                                                                                                                                                                                  MD5:6720D5DCDA6737EB0CC5A352A47414DC
                                                                                                                                                                                                                  SHA1:03D9A8E350F485DD955F7DEE06BFC46371753032
                                                                                                                                                                                                                  SHA-256:D8F36B089D83157ABC271D9FE125919C3237943FA9789A511AC5EF1D41E2E3AF
                                                                                                                                                                                                                  SHA-512:DE5ADE6CE14B14957FCE669C4181AF1E6A6F540798D1C6720B56FF281F813A6CE4446BDE33A8F175D2484E07F4911F93A773CAC1D372CBE3B26BE634B3FA1686
                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                  Antivirus:
                                                                                                                                                                                                                  • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                  Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d......g.........." ......B.........P.;.......................................U...........`A..........................................O.......O.P....PU.......S..W...........`U.......O......................O.(.....B.@.............P.8............................text...g.B.......B................. ..`.rdata........B.......B.............@..@.data...H.....P.......P.............@....pdata...W....S..X...VR.............@..@.gxfg...0.....T..0....S.............@..@.retplne..... U.......S..................tls....Y....0U.......S.............@..._RDATA.......@U.......S.............@..@.rsrc........PU.......S.............@..@.reloc.......`U.......S.............@..B........................................................................................................................................................................................................................

                                                                                                                                                                                                                  C:\Users\user\AppData\Local\Temp\nshFAEA.tmp\7z-out\vk_swiftshader_icd.json

                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                  Process:C:\Users\user\Desktop\cMqyGFCQHk.exe
                                                                                                                                                                                                                  File Type:JSON data
                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                  Size (bytes):106
                                                                                                                                                                                                                  Entropy (8bit):4.724752649036734
                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                  SSDEEP:3:YD96WyV18tzsmyXLVi1rTVWSCwW2TJHzeZ18rY:Y8WyV18tAZLVmCwXFiZ18rY
                                                                                                                                                                                                                  MD5:8642DD3A87E2DE6E991FAE08458E302B
                                                                                                                                                                                                                  SHA1:9C06735C31CEC00600FD763A92F8112D085BD12A
                                                                                                                                                                                                                  SHA-256:32D83FF113FEF532A9F97E0D2831F8656628AB1C99E9060F0332B1532839AFD9
                                                                                                                                                                                                                  SHA-512:F5D37D1B45B006161E4CEFEEBBA1E33AF879A3A51D16EE3FF8C3968C0C36BBAFAE379BF9124C13310B77774C9CBB4FA53114E83F5B48B5314132736E5BB4496F
                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                  Preview:{"file_format_version": "1.0.0", "ICD": {"library_path": ".\\vk_swiftshader.dll", "api_version": "1.0.5"}}

                                                                                                                                                                                                                  C:\Users\user\AppData\Local\Temp\nshFAEA.tmp\7z-out\vulkan-1.dll

                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                  Process:C:\Users\user\Desktop\cMqyGFCQHk.exe
                                                                                                                                                                                                                  File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                  Size (bytes):894976
                                                                                                                                                                                                                  Entropy (8bit):6.60309283089771
                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                  SSDEEP:24576:FhJnfYUcguY3cTAL6Z5WjDYsHy6g3P0zAk7TNb:FhVrXN3oAL6Z5WjDYsHy6g3P0zAk7T
                                                                                                                                                                                                                  MD5:B6D3AF84E8BE0027741AA6077768789E
                                                                                                                                                                                                                  SHA1:E525F2434DC56F79644695F5841E91DD5F80EEC4
                                                                                                                                                                                                                  SHA-256:376FF6892EC7B406ACD8C455AC82F8541E59E3757195488FF04CD9F20D554562
                                                                                                                                                                                                                  SHA-512:F03B8792A740679C8A1A8CE0615B7876CC811130085F3FFB42182E0CB846519603804DA97FC93A8ABEBEE01E03FD257DF289C54575DA8FAAAD018F4F4BAE606A
                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                  Antivirus:
                                                                                                                                                                                                                  • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                  Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d......g.........." .........................................................@............`A........................................PL..<!...m..P.... .......P..ha...........0..$....:.......................9..(.......@............q...............................text............................... ..`.rdata..............................@..@.data....L......."..................@....pdata..ha...P...b..................@..@.gxfg....%.......&...j..............@..@.retplne.................................tls................................@..._RDATA..............................@..@.rsrc........ ......................@..@.reloc..$....0......................@..B........................................................................................................................................................................................................................

                                                                                                                                                                                                                  C:\Users\user\AppData\Local\Temp\nshFAEA.tmp\SpiderBanner.dll

                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                  Process:C:\Users\user\Desktop\cMqyGFCQHk.exe
                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                  Size (bytes):9216
                                                                                                                                                                                                                  Entropy (8bit):5.5347224014600345
                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                  SSDEEP:192:5lkE3uqRI1y7/xcfK4PRef6gQzJyY1rpKlVrw:5lkMBI1y7UKcef6XzJrpKY
                                                                                                                                                                                                                  MD5:17309E33B596BA3A5693B4D3E85CF8D7
                                                                                                                                                                                                                  SHA1:7D361836CF53DF42021C7F2B148AEC9458818C01
                                                                                                                                                                                                                  SHA-256:996A259E53CA18B89EC36D038C40148957C978C0FD600A268497D4C92F882A93
                                                                                                                                                                                                                  SHA-512:1ABAC3CE4F2D5E4A635162E16CF9125E059BA1539F70086C2D71CD00D41A6E2A54D468E6F37792E55A822D7082FB388B8DFECC79B59226BBB047B7D28D44D298
                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                  Antivirus:
                                                                                                                                                                                                                  • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........N.../../../..Wy./../../....../..Wi./..Wx./..W~./..W{./..Rich./..................PE..L...T{mW...........!................p!.......0...............................p............@..........................5..o...l1..P....P.......................`.......................................................0...............................text............................... ..`.rdata.......0......................@..@.data........@......................@....rsrc........P......................@..@.reloc..d....`....... ..............@..B........................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                  C:\Users\user\AppData\Local\Temp\nshFAEA.tmp\StdUtils.dll

                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                  Process:C:\Users\user\Desktop\cMqyGFCQHk.exe
                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                  Size (bytes):102400
                                                                                                                                                                                                                  Entropy (8bit):6.729923587623207
                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                  SSDEEP:3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v
                                                                                                                                                                                                                  MD5:C6A6E03F77C313B267498515488C5740
                                                                                                                                                                                                                  SHA1:3D49FC2784B9450962ED6B82B46E9C3C957D7C15
                                                                                                                                                                                                                  SHA-256:B72E9013A6204E9F01076DC38DABBF30870D44DFC66962ADBF73619D4331601E
                                                                                                                                                                                                                  SHA-512:9870C5879F7B72836805088079AD5BBAFCB59FC3D9127F2160D4EC3D6E88D3CC8EBE5A9F5D20A4720FE6407C1336EF10F33B2B9621BC587E930D4CBACF337803
                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                  Antivirus:
                                                                                                                                                                                                                  • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........q....C...C...C...C...C...C...C...C...C...C...C...C...C.[.C...C.[.C...C.[.C...C.[.C...CRich...C........................PE..L...I..[...........!.....*...b...............@.......................................+....@..........................}..d....t..........X............................................................................@...............................text....).......*.................. ..`.rdata..TC...@...D..................@..@.data...l............r..............@....rsrc...X............x..............@..@.reloc..j............~..............@..B................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                  C:\Users\user\AppData\Local\Temp\nshFAEA.tmp\System.dll

                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                  Process:C:\Users\user\Desktop\cMqyGFCQHk.exe
                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                  Size (bytes):12288
                                                                                                                                                                                                                  Entropy (8bit):5.719859767584478
                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                  SSDEEP:192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
                                                                                                                                                                                                                  MD5:0D7AD4F45DC6F5AA87F606D0331C6901
                                                                                                                                                                                                                  SHA1:48DF0911F0484CBE2A8CDD5362140B63C41EE457
                                                                                                                                                                                                                  SHA-256:3EB38AE99653A7DBC724132EE240F6E5C4AF4BFE7C01D31D23FAF373F9F2EACA
                                                                                                                                                                                                                  SHA-512:C07DE7308CB54205E8BD703001A7FE4FD7796C9AC1B4BB330C77C872BF712B093645F40B80CE7127531FE6746A5B66E18EA073AB6A644934ABED9BB64126FEA9
                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                  Antivirus:
                                                                                                                                                                                                                  • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......qr*.5.D.5.D.5.D...J.2.D.5.E.!.D.....2.D.a0t.1.D.V1n.4.D..3@.4.D.Rich5.D.........PE..L....~.\...........!....."...........).......@...............................p............@..........................B.......@..P............................`.......................................................@..X............................text.... .......".................. ..`.rdata..c....@.......&..............@..@.data...x....P.......*..............@....reloc.......`.......,..............@..B................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                  C:\Users\user\AppData\Local\Temp\nshFAEA.tmp\app-64.7z

                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                  Process:C:\Users\user\Desktop\cMqyGFCQHk.exe
                                                                                                                                                                                                                  File Type:7-zip archive data, version 0.4
                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                  Size (bytes):86108360
                                                                                                                                                                                                                  Entropy (8bit):7.999996269102668
                                                                                                                                                                                                                  Encrypted:true
                                                                                                                                                                                                                  SSDEEP:1572864:a2/ebAbWsL+/5FLl9Noabh+XJhXhQiB1dJdYVkq7U4hmfiGW5:k0bu5hl9OOh01VJY+qw0uiT5
                                                                                                                                                                                                                  MD5:50FA2EE0FAF16367F635CC4BCC474EF7
                                                                                                                                                                                                                  SHA1:0F2177987A6F48D736A73EFFACAA4CE84571E153
                                                                                                                                                                                                                  SHA-256:163B44F1FA2CE29B30607E44D8C59998749007D055F5A90BF2B8ACD90DE0D4F1
                                                                                                                                                                                                                  SHA-512:040D9AE055368EBE31A59BB31AD5617A693681DD329DCAFA176BBC6F8F4B6915F9732F7B5290F48EAC186BF665A1A5B654FCA2599D1F2A73B358437EEA59A4EF
                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                  Preview:7z..'...7xz..!.....%...............]...6.....#.0@.1.zL..[...4b ...A....Z7.~...........}.......m.7!*Q..X,s..T...>~(|.s..%...1`.Yw......vK.Tz.|pu.96...D.......w,2PO;I..Z.{..I..y.pn...P..*G.a...Z...(....R..R8|.\....L...k..}..s&.'.....0.."o.s.ZI.=.(.C.?.Gg...|..^....;.e[.w....<.n.@..&Z...$`p ..OzD...V..r.l...ibH..hv."6.m.5.T{*4nh.....Sx.G..1.'.....8.."..................Zk!`.fd..qN.....{.......O.$.|r.{.a|^.]..K*n..t..e.......o.s.v}.....2[M..1..yG..]Y. ...Z=....?.\#*..)...!k...X....G.%>......t..7.}.G.~HV..D.[.....4....!.....=.r.../P.5*..j1^.!..W).!...J.!H0....Rj..[..0.y.u...5..bC...\..{...Cv...`xN|....2m.A.{..m..y).*B.q.D.y...j.\.R#.CX\n..L>.NN.]..cj{>..p.j}.&..Z<.`7....o.......k..z.. ...?..~g.|m....kysn.q.., b>'.:,p...... .......V..x........0j.......F..3....W.......xO.....w.q..a....s.4#.GWP.........r'...K....+_^"0T=.+.....u)......xEP.Il.}.P>.@{.9{.......*...Q..E..[..[34..wx....Z...$..U.....vg....k.......Z.$j....#.b.rF....#5...XO.u...saZ...'.

                                                                                                                                                                                                                  C:\Users\user\AppData\Local\Temp\nshFAEA.tmp\nsExec.dll

                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                  Process:C:\Users\user\Desktop\cMqyGFCQHk.exe
                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                  Size (bytes):6656
                                                                                                                                                                                                                  Entropy (8bit):5.155286976455086
                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                  SSDEEP:96:YjHFiKaoggCtJzTlKXb0tbo68qD853Ns7GgmkNq3m+s:JbogRtJzTlNR8qD85uGgmkNr
                                                                                                                                                                                                                  MD5:EC0504E6B8A11D5AAD43B296BEEB84B2
                                                                                                                                                                                                                  SHA1:91B5CE085130C8C7194D66B2439EC9E1C206497C
                                                                                                                                                                                                                  SHA-256:5D9CEB1CE5F35AEA5F9E5A0C0EDEEEC04DFEFE0C77890C80C70E98209B58B962
                                                                                                                                                                                                                  SHA-512:3F918F1B47E8A919CBE51EB17DC30ACC8CFC18E743A1BAE5B787D0DB7D26038DC1210BE98BF5BA3BE8D6ED896DBBD7AC3D13E66454A98B2A38C7E69DAD30BB57
                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                  Antivirus:
                                                                                                                                                                                                                  • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........................,..................Rich...........PE..L....~.\...........!......................... ...............................P............@..........................$..l.... ..P............................@....................................................... ...............................text............................... ..`.rdata..L.... ......................@..@.data........0......................@....reloc.......@......................@..B................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                  C:\Users\user\AppData\Local\Temp\nshFAEA.tmp\nsis7z.dll

                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                  Process:C:\Users\user\Desktop\cMqyGFCQHk.exe
                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                  Size (bytes):434176
                                                                                                                                                                                                                  Entropy (8bit):6.584811966667578
                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                  SSDEEP:6144:aUWQQ5O3fz0NG3ucDaEUTWfk+ZA0NrCL/k+uyoyBOX1okfW7w+Pfzqibckl:an5QEG39fPAkrE4yrBOXDfaNbck
                                                                                                                                                                                                                  MD5:80E44CE4895304C6A3A831310FBF8CD0
                                                                                                                                                                                                                  SHA1:36BD49AE21C460BE5753A904B4501F1ABCA53508
                                                                                                                                                                                                                  SHA-256:B393F05E8FF919EF071181050E1873C9A776E1A0AE8329AEFFF7007D0CADF592
                                                                                                                                                                                                                  SHA-512:C8BA7B1F9113EAD23E993E74A48C4427AE3562C1F6D9910B2BBE6806C9107CF7D94BC7D204613E4743D0CD869E00DAFD4FB54AAD1E8ADB69C553F3B9E5BC64DF
                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                  Antivirus:
                                                                                                                                                                                                                  • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......L.6a..X2..X2..X2m.[3..X2m.]3..X2Z.]3+.X2Z.\3..X2Z.[3..X2m.\3..X2m.Y3..X2..Y2..X2..\3#.X2..]3..X2..X3..X2...2..X2...2..X2..Z3..X2Rich..X2........PE..L.....\...........!......................... ...............................@............@..........................6.......7..d................................E.....................................@............ ...............................text............................... ..`.rdata..8"... ...$..................@..@.data........P... ...6..............@....rsrc................V..............@..@.reloc...E.......F...Z..............@..B........................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                  C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MyElectronApp.lnk

                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                  Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                  File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Thu Nov 14 17:55:38 2024, mtime=Thu Nov 14 17:55:48 2024, atime=Thu Nov 14 09:40:50 2024, length=188819968, window=hide
                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                  Size (bytes):1165
                                                                                                                                                                                                                  Entropy (8bit):4.92113923638471
                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                  SSDEEP:24:8JH0DplXZXHRUoo4J9lWyxSlWdAbanGglWGlWz733qygm:8JH0Dplp3RUoo4JHfc5GnGgNA+yg
                                                                                                                                                                                                                  MD5:AD6DCF42CD15641082868A7EB2766522
                                                                                                                                                                                                                  SHA1:5D301463FCD66E703A48A670A69991222CECD160
                                                                                                                                                                                                                  SHA-256:ADCB16C2837518CE3AC1F147B6D1C72B4AF9EF5C74DC62FBFC584DC0A01B25FE
                                                                                                                                                                                                                  SHA-512:04F6825DE59B6E90C8D715A6E0574860676E4BDC606C1D52F130EB4CFF79DEFD371F1D692CB83CB2C0860CA6B6884F895CA20DB8DEC191F5E7D75DA8196F8D4F
                                                                                                                                                                                                                  Malicious:true
                                                                                                                                                                                                                  Preview:L..................F.... ........6....t..6.....6...*A.......................:..DG..Yr?.D..U..k0.&...&.......$..S....;...6...W...6......t...CFSF..1.....EW<2..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......EW<2nY............................^.A.p.p.D.a.t.a...B.P.1.....nY....Local.<......EW<2nY......[.......................e.L.o.c.a.l.....Z.1.....nY...Programs..B......nY.nY.....+.....................&.-.P.r.o.g.r.a.m.s.....P.1.....nY....Teams.<......nY.nY......?.......................Y.T.e.a.m.s.....\.2..*A.nY.U .Teams.exe.D......nY..nY................................T.e.a.m.s...e.x.e.......g...............-.......f...........e........C:\Users\user\AppData\Local\Programs\Teams\Teams.exe..0.....\.....\.....\.....\.....\.....\.L.o.c.a.l.\.P.r.o.g.r.a.m.s.\.T.e.a.m.s.\.T.e.a.m.s...e.x.e.............:...........|....I.J.H..K..:...`.......X.......888683...........hT..CrF.f4... ..$..Jc...-...-$..hT..CrF.f4... ..$..Jc...-...-$.............1SPS.XF.L8C....&.m.q............/...

                                                                                                                                                                                                                  C:\Users\user\AppData\Roaming\Teams\Local State (copy)

                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Programs\Teams\Teams.exe
                                                                                                                                                                                                                  File Type:JSON data
                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                  Size (bytes):434
                                                                                                                                                                                                                  Entropy (8bit):5.656248644603546
                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                  SSDEEP:6:YKWCRGBmEuZpn9RdrtybHdNwGirlWPu9a8Ikv/t4CQNxMtts0gtvxZxj9qsOUY:YKWSCuj9rrt+9NwGikm/PF4Ca0gbjFY
                                                                                                                                                                                                                  MD5:6C22E2DAFD725F57001F05A2D82F2E29
                                                                                                                                                                                                                  SHA1:9AD97700F844485AD3A284DA27C10DF95B16ED85
                                                                                                                                                                                                                  SHA-256:41CE30F50BB0735A9AB4157840A42C3E11EF0C155562DE3C9D0384EE0E3740F4
                                                                                                                                                                                                                  SHA-512:8B2508B78FF00DDB81A33A51568E0A1D827FB2375C08300B83C18AFD1BDA506BFB29A2930BF427E8F9123AFA33651189A6DD6C45DFED8FCA4861726427C82A8F
                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                  Preview:{"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAABEq4E4q3g5Rp349qh2ZKQhEAAAABIAAABDAGgAcgBvAG0AaQB1AG0AAAAQZgAAAAEAACAAAAD78sybhWEvIRHhAImajrw09y7WReS6f94OgPT/X8xowAAAAAAOgAAAAAIAACAAAADNwrfCLwKu82S9YhT2hoJhOlCBwxnj4sLBBe+sFPrMLDAAAAA2CPnwpOXoKWAZjgs26JzAdK99cNWWuPdpkooSuBMKnIQfDhHHgWHQz4X+gpKEvUtAAAAA2Nw7R16KbtHJImliwv61NGyvELYVmJQ0TC8x6QtqARfTfrBOgY3FEFOHw2ZLY7gO6P2gNCytulusmV7tA9BJ4Q=="}}

                                                                                                                                                                                                                  C:\Users\user\AppData\Roaming\Teams\config.json

                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Programs\Teams\Teams.exe
                                                                                                                                                                                                                  File Type:JSON data
                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                  Size (bytes):73
                                                                                                                                                                                                                  Entropy (8bit):4.658132263974194
                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                  SSDEEP:3:NBH1//W7W0zDK8BHEKY:L1j8BHEKY
                                                                                                                                                                                                                  MD5:8D8DB5B79ACC2648A1AC85A2404B2BF5
                                                                                                                                                                                                                  SHA1:2F3D16329796B738E1542BEF23C80A40F9D65D24
                                                                                                                                                                                                                  SHA-256:7B235A986365DCE10EBCF65A2385E4C91A6444B594A3B9F7DF5B6923A1CEE043
                                                                                                                                                                                                                  SHA-512:2C15BDCDD42C14E6824AE7A81A753B32948E5A7789A9F1A85946171E7EA11F5E07E6F36161521CDD90D4850E93D2707BE6E7C3AD1893E7E9D6A46E4A71CCD850
                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                  Preview:{. "uuid": "247696e7-cd8a-4026-acd5-243d5f73d20b",. "installed": true.}

                                                                                                                                                                                                                  C:\Users\user\AppData\Roaming\Teams\f2734e98-7c99-4380-93a6-563a4140ae2d.tmp

                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Programs\Teams\Teams.exe
                                                                                                                                                                                                                  File Type:JSON data
                                                                                                                                                                                                                  Category:modified
                                                                                                                                                                                                                  Size (bytes):434
                                                                                                                                                                                                                  Entropy (8bit):5.656248644603546
                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                  SSDEEP:6:YKWCRGBmEuZpn9RdrtybHdNwGirlWPu9a8Ikv/t4CQNxMtts0gtvxZxj9qsOUY:YKWSCuj9rrt+9NwGikm/PF4Ca0gbjFY
                                                                                                                                                                                                                  MD5:6C22E2DAFD725F57001F05A2D82F2E29
                                                                                                                                                                                                                  SHA1:9AD97700F844485AD3A284DA27C10DF95B16ED85
                                                                                                                                                                                                                  SHA-256:41CE30F50BB0735A9AB4157840A42C3E11EF0C155562DE3C9D0384EE0E3740F4
                                                                                                                                                                                                                  SHA-512:8B2508B78FF00DDB81A33A51568E0A1D827FB2375C08300B83C18AFD1BDA506BFB29A2930BF427E8F9123AFA33651189A6DD6C45DFED8FCA4861726427C82A8F
                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                  Preview:{"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAABEq4E4q3g5Rp349qh2ZKQhEAAAABIAAABDAGgAcgBvAG0AaQB1AG0AAAAQZgAAAAEAACAAAAD78sybhWEvIRHhAImajrw09y7WReS6f94OgPT/X8xowAAAAAAOgAAAAAIAACAAAADNwrfCLwKu82S9YhT2hoJhOlCBwxnj4sLBBe+sFPrMLDAAAAA2CPnwpOXoKWAZjgs26JzAdK99cNWWuPdpkooSuBMKnIQfDhHHgWHQz4X+gpKEvUtAAAAA2Nw7R16KbtHJImliwv61NGyvELYVmJQ0TC8x6QtqARfTfrBOgY3FEFOHw2ZLY7gO6P2gNCytulusmV7tA9BJ4Q=="}}

                                                                                                                                                                                                                  \Device\Null

                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                  Process:C:\Users\user\AppData\Local\Programs\Teams\Teams.exe
                                                                                                                                                                                                                  File Type:ASCII text, with very long lines (427)
                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                  Size (bytes):903
                                                                                                                                                                                                                  Entropy (8bit):4.878485099691774
                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                  SSDEEP:12:CnCUUC7QdaIWEJdWdV+saIWEJxSqzDttrdonjN00L/WUu5QAmH+NcczIXoeZC+F:uUKQdahz+sawDxVE/xmQoNcckXoex
                                                                                                                                                                                                                  MD5:27AA59593F8D70ED89E0C29ED9D3DE38
                                                                                                                                                                                                                  SHA1:1EDFA64684CFF30C701B5ED3A765759AB5D58EFF
                                                                                                                                                                                                                  SHA-256:44D24E3C3ADA3F33225710DC28D3A1047956833F365804DE51531DEDF43ABE2F
                                                                                                                                                                                                                  SHA-512:C1CAE5F798D57C326870EC4224614159019130A7893BC776AC6D65841CAC7440DDF3A5800A7C0F4197AE8945109F7C3B858114B6AA6884A8C4E73E94EC41F31E
                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                  Preview:(node:5544) UnhandledPromiseRejectionWarning: TypeError: Cannot read properties of undefined (reading 'model'). at getSystemInfo (C:\Users\user\AppData\Local\Programs\Teams\resources\app.asar\main.js:50:31). at App.<anonymous> (C:\Users\user\AppData\Local\Programs\Teams\resources\app.asar\main.js:329:24). at process.processTicksAndRejections (node:internal/process/task_queues:95:5).(Use `Teams --trace-warnings ...` to show where the warning was created).(node:5544) UnhandledPromiseRejectionWarning: Unhandled promise rejection. This error originated either by throwing inside of an async function without a catch block, or by rejecting a promise which was not handled with .catch(). To terminate the node process on unhandled promise rejection, use the CLI flag `--unhandled-rejections=strict` (see https://nodejs.org/api/cli.html#cli_unhandled_rejections_mode). (rejection id: 1).

                                                                                                                                                                                                                  Static File Info

                                                                                                                                                                                                                  General

                                                                                                                                                                                                                  File type:PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
                                                                                                                                                                                                                  Entropy (8bit):7.999770167797606
                                                                                                                                                                                                                  TrID:
                                                                                                                                                                                                                  • Win32 Executable (generic) a (10002005/4) 99.96%
                                                                                                                                                                                                                  • Generic Win/DOS Executable (2004/3) 0.02%
                                                                                                                                                                                                                  • DOS Executable Generic (2002/1) 0.02%
                                                                                                                                                                                                                  • Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
                                                                                                                                                                                                                  File name:cMqyGFCQHk.exe
                                                                                                                                                                                                                  File size:86'797'392 bytes
                                                                                                                                                                                                                  MD5:b408e3da98f0e457d627510165374ddd
                                                                                                                                                                                                                  SHA1:49de055d881896670ce8b1ba1633d5f8b4f8e193
                                                                                                                                                                                                                  SHA256:3c3f458400c557d279c4d4993f67adc8ba3da4bad8fc844adfef8c7de475a1f7
                                                                                                                                                                                                                  SHA512:3a092bd3ec86a4793a94b0e7b0dd50f50a1b9ea6c65b0628e912b7df967e267b236dbbee6b7d4fbc9deed6c5bc879ec5c2ee5f7bfe9460ec75121ebdfe7a4a73
                                                                                                                                                                                                                  SSDEEP:1572864:4k2/ebAbWsL+/5FLl9Noabh+XJhXhQiB1dJdYVkq7U4hmfiGWk:4G0bu5hl9OOh01VJY+qw0uiTk
                                                                                                                                                                                                                  TLSH:5E1833980792C262D3E414B8E5F363FB31027E1A8B351A993124B6DCF6271DA15B58FF
                                                                                                                                                                                                                  File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1...Pf..Pf..Pf.*_9..Pf..Pg.LPf.*_;..Pf..sV..Pf..V`..Pf.Rich.Pf.........................PE..L......\.................h...8...@.

                                                                                                                                                                                                                  File Icon

                                                                                                                                                                                                                  Icon Hash:4c4f64e46464070e

                                                                                                                                                                                                                  Static PE Info

                                                                                                                                                                                                                  General

                                                                                                                                                                                                                  Entrypoint:0x40338f
                                                                                                                                                                                                                  Entrypoint Section:.text
                                                                                                                                                                                                                  Digitally signed:true
                                                                                                                                                                                                                  Imagebase:0x400000
                                                                                                                                                                                                                  Subsystem:windows gui
                                                                                                                                                                                                                  Image File Characteristics:RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
                                                                                                                                                                                                                  DLL Characteristics:DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
                                                                                                                                                                                                                  Time Stamp:0x5C157F86 [Sat Dec 15 22:26:14 2018 UTC]
                                                                                                                                                                                                                  TLS Callbacks:
                                                                                                                                                                                                                  CLR (.Net) Version:
                                                                                                                                                                                                                  OS Version Major:4
                                                                                                                                                                                                                  OS Version Minor:0
                                                                                                                                                                                                                  File Version Major:4
                                                                                                                                                                                                                  File Version Minor:0
                                                                                                                                                                                                                  Subsystem Version Major:4
                                                                                                                                                                                                                  Subsystem Version Minor:0
                                                                                                                                                                                                                  Import Hash:b34f154ec913d2d2c435cbd644e91687

                                                                                                                                                                                                                  Authenticode Signature

                                                                                                                                                                                                                  Signature Valid:false
                                                                                                                                                                                                                  Signature Issuer:CN=GlobalSign GCC R45 EV CodeSigning CA 2020, O=GlobalSign nv-sa, C=BE
                                                                                                                                                                                                                  Signature Validation Error:A required certificate is not within its validity period when verifying against the current system clock or the timestamp in the signed file
                                                                                                                                                                                                                  Error Number:-2146762495
                                                                                                                                                                                                                  Not Before, Not After
                                                                                                                                                                                                                  • 15/10/2024 20:29:09 16/10/2025 20:29:09
                                                                                                                                                                                                                  Subject Chain
                                                                                                                                                                                                                  • CN="Lion Software, LLC", O="Lion Software, LLC", STREET=60 County Road 537, L=Centre, S=Alabama, C=US, OID.1.3.6.1.4.1.311.60.2.1.2=Alabama, OID.1.3.6.1.4.1.311.60.2.1.3=US, SERIALNUMBER=000-541-240, OID.2.5.4.15=Private Organization
                                                                                                                                                                                                                  Version:3
                                                                                                                                                                                                                  Thumbprint MD5:AC575FB5F87D72747656ED9FFBAEB0DA
                                                                                                                                                                                                                  Thumbprint SHA-1:A243692CD9205CFE32BEEF144B7D84350F3AA0E6
                                                                                                                                                                                                                  Thumbprint SHA-256:482DFF658DB3FF3B08ED60A99B5434DE6E8CF3F1DCB782831AA0B22978F7C49D
                                                                                                                                                                                                                  Serial:1AF0A44396DD57AC87ECB79D

                                                                                                                                                                                                                  Entrypoint Preview

                                                                                                                                                                                                                  Instruction
                                                                                                                                                                                                                  sub esp, 000002D4h
                                                                                                                                                                                                                  push ebx
                                                                                                                                                                                                                  push esi
                                                                                                                                                                                                                  push edi
                                                                                                                                                                                                                  push 00000020h
                                                                                                                                                                                                                  pop edi
                                                                                                                                                                                                                  xor ebx, ebx
                                                                                                                                                                                                                  push 00008001h
                                                                                                                                                                                                                  mov dword ptr [esp+14h], ebx
                                                                                                                                                                                                                  mov dword ptr [esp+10h], 0040A2E0h
                                                                                                                                                                                                                  mov dword ptr [esp+1Ch], ebx
                                                                                                                                                                                                                  call dword ptr [004080A8h]
                                                                                                                                                                                                                  call dword ptr [004080A4h]
                                                                                                                                                                                                                  and eax, BFFFFFFFh
                                                                                                                                                                                                                  cmp ax, 00000006h
                                                                                                                                                                                                                  mov dword ptr [0047AEECh], eax
                                                                                                                                                                                                                  je 00007FE014D306B3h
                                                                                                                                                                                                                  push ebx
                                                                                                                                                                                                                  call 00007FE014D33965h
                                                                                                                                                                                                                  cmp eax, ebx
                                                                                                                                                                                                                  je 00007FE014D306A9h
                                                                                                                                                                                                                  push 00000C00h
                                                                                                                                                                                                                  call eax
                                                                                                                                                                                                                  mov esi, 004082B0h
                                                                                                                                                                                                                  push esi
                                                                                                                                                                                                                  call 00007FE014D338DFh
                                                                                                                                                                                                                  push esi
                                                                                                                                                                                                                  call dword ptr [00408150h]
                                                                                                                                                                                                                  lea esi, dword ptr [esi+eax+01h]
                                                                                                                                                                                                                  cmp byte ptr [esi], 00000000h
                                                                                                                                                                                                                  jne 00007FE014D3068Ch
                                                                                                                                                                                                                  push 0000000Ah
                                                                                                                                                                                                                  call 00007FE014D33938h
                                                                                                                                                                                                                  push 00000008h
                                                                                                                                                                                                                  call 00007FE014D33931h
                                                                                                                                                                                                                  push 00000006h
                                                                                                                                                                                                                  mov dword ptr [0047AEE4h], eax
                                                                                                                                                                                                                  call 00007FE014D33925h
                                                                                                                                                                                                                  cmp eax, ebx
                                                                                                                                                                                                                  je 00007FE014D306B1h
                                                                                                                                                                                                                  push 0000001Eh
                                                                                                                                                                                                                  call eax
                                                                                                                                                                                                                  test eax, eax
                                                                                                                                                                                                                  je 00007FE014D306A9h
                                                                                                                                                                                                                  or byte ptr [0047AEEFh], 00000040h
                                                                                                                                                                                                                  push ebp
                                                                                                                                                                                                                  call dword ptr [00408044h]
                                                                                                                                                                                                                  push ebx
                                                                                                                                                                                                                  call dword ptr [004082A0h]
                                                                                                                                                                                                                  mov dword ptr [0047AFB8h], eax
                                                                                                                                                                                                                  push ebx
                                                                                                                                                                                                                  lea eax, dword ptr [esp+34h]
                                                                                                                                                                                                                  push 000002B4h
                                                                                                                                                                                                                  push eax
                                                                                                                                                                                                                  push ebx
                                                                                                                                                                                                                  push 00440208h
                                                                                                                                                                                                                  call dword ptr [00408188h]
                                                                                                                                                                                                                  push 0040A2C8h

                                                                                                                                                                                                                  Rich Headers

                                                                                                                                                                                                                  Programming Language:
                                                                                                                                                                                                                  • [EXP] VC++ 6.0 SP5 build 8804

                                                                                                                                                                                                                  Data Directories

                                                                                                                                                                                                                  NameVirtual AddressVirtual Size Is in Section
                                                                                                                                                                                                                  IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
                                                                                                                                                                                                                  IMAGE_DIRECTORY_ENTRY_IMPORT0x86100xa0.rdata
                                                                                                                                                                                                                  IMAGE_DIRECTORY_ENTRY_RESOURCE0x19f0000x2c4d8.rsrc
                                                                                                                                                                                                                  IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
                                                                                                                                                                                                                  IMAGE_DIRECTORY_ENTRY_SECURITY0x52c5a280x1228
                                                                                                                                                                                                                  IMAGE_DIRECTORY_ENTRY_BASERELOC0x00x0
                                                                                                                                                                                                                  IMAGE_DIRECTORY_ENTRY_DEBUG0x00x0
                                                                                                                                                                                                                  IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
                                                                                                                                                                                                                  IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
                                                                                                                                                                                                                  IMAGE_DIRECTORY_ENTRY_TLS0x00x0
                                                                                                                                                                                                                  IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x00x0
                                                                                                                                                                                                                  IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
                                                                                                                                                                                                                  IMAGE_DIRECTORY_ENTRY_IAT0x80000x2b0.rdata
                                                                                                                                                                                                                  IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
                                                                                                                                                                                                                  IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x00x0
                                                                                                                                                                                                                  IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

                                                                                                                                                                                                                  Sections

                                                                                                                                                                                                                  NameVirtual AddressVirtual SizeRaw SizeMD5Xored PEZLIB ComplexityFile TypeEntropyCharacteristics
                                                                                                                                                                                                                  .text0x10000x66270x68007618d4c0cd8bb67ea9595b4266b3a91fFalse0.6646259014423077data6.450282348506287IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                                                                                                                                                                                                                  .rdata0x80000x14a20x1600eecac1fed9cc6b447d50940d178404d8False0.4405184659090909data5.025178929113415IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                                                                                                                                                                  .data0xa0000x70ff80x600db8f31a08a2242d80c29e1f9500c6527False0.5182291666666666data4.037117731448378IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                                                                                                                                                                                  .ndata0x7b0000x1240000x0d41d8cd98f00b204e9800998ecf8427eFalse0empty0.0IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                                                                                                                                                                                  .rsrc0x19f0000x2c4d80x2c60017ecf0cb331acf3e0aa34f7130f91d58False0.20090779049295773data4.330797014530664IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

                                                                                                                                                                                                                  Resources

                                                                                                                                                                                                                  NameRVASizeTypeLanguageCountryZLIB Complexity
                                                                                                                                                                                                                  RT_ICON0x19f7d80x94a8Device independent bitmap graphic, 96 x 192 x 32, image size 38016EnglishUnited States0.10857683413916334
                                                                                                                                                                                                                  RT_ICON0x1a8c800x67e8Device independent bitmap graphic, 80 x 160 x 32, image size 26560EnglishUnited States0.11736842105263158
                                                                                                                                                                                                                  RT_ICON0x1af4680x5488Device independent bitmap graphic, 72 x 144 x 32, image size 21600EnglishUnited States0.1307301293900185
                                                                                                                                                                                                                  RT_ICON0x1b48f00x4228Device independent bitmap graphic, 64 x 128 x 32, image size 16896EnglishUnited States0.1379900803023146
                                                                                                                                                                                                                  RT_ICON0x1b8b180x3a48Device independent bitmap graphic, 60 x 120 x 32, image size 14880EnglishUnited States0.14711796246648792
                                                                                                                                                                                                                  RT_ICON0x1bc5600x3524PNG image data, 256 x 256, 8-bit/color RGBA, non-interlacedEnglishUnited States0.9886062922669803
                                                                                                                                                                                                                  RT_ICON0x1bfa880x25a8Device independent bitmap graphic, 48 x 96 x 32, image size 9600EnglishUnited States0.18443983402489628
                                                                                                                                                                                                                  RT_ICON0x1c20300x1a68Device independent bitmap graphic, 40 x 80 x 32, image size 6720EnglishUnited States0.20310650887573964
                                                                                                                                                                                                                  RT_ICON0x1c3a980x1628Device independent bitmap graphic, 64 x 128 x 8, image size 4096, 256 important colorsEnglishUnited States0.24876586741889986
                                                                                                                                                                                                                  RT_ICON0x1c50c00x10a8Device independent bitmap graphic, 32 x 64 x 32, image size 4224EnglishUnited States0.08864915572232646
                                                                                                                                                                                                                  RT_ICON0x1c61680xea8Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colorsEnglishUnited States0.298773987206823
                                                                                                                                                                                                                  RT_ICON0x1c70100x988Device independent bitmap graphic, 24 x 48 x 32, image size 2400EnglishUnited States0.125
                                                                                                                                                                                                                  RT_ICON0x1c79980x8a8Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colorsEnglishUnited States0.1565884476534296
                                                                                                                                                                                                                  RT_ICON0x1c82400x6b8Device independent bitmap graphic, 20 x 40 x 32, image size 1680EnglishUnited States0.13895348837209304
                                                                                                                                                                                                                  RT_ICON0x1c88f80x568Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colorsEnglishUnited States0.16329479768786126
                                                                                                                                                                                                                  RT_ICON0x1c8e600x468Device independent bitmap graphic, 16 x 32 x 32, image size 1088EnglishUnited States0.17819148936170212
                                                                                                                                                                                                                  RT_ICON0x1c92c80x2e8Device independent bitmap graphic, 32 x 64 x 4, image size 512EnglishUnited States0.3064516129032258
                                                                                                                                                                                                                  RT_ICON0x1c95b00x128Device independent bitmap graphic, 16 x 32 x 4, image size 128EnglishUnited States0.48986486486486486
                                                                                                                                                                                                                  RT_DIALOG0x1c96d80x202dataEnglishUnited States0.4085603112840467
                                                                                                                                                                                                                  RT_DIALOG0x1c98e00xf8dataEnglishUnited States0.6290322580645161
                                                                                                                                                                                                                  RT_DIALOG0x1c99d80xeedataEnglishUnited States0.6260504201680672
                                                                                                                                                                                                                  RT_DIALOG0x1c9ac80x1fadataEnglishUnited States0.40118577075098816
                                                                                                                                                                                                                  RT_DIALOG0x1c9cc80xf0dataEnglishUnited States0.6666666666666666
                                                                                                                                                                                                                  RT_DIALOG0x1c9db80xe6dataEnglishUnited States0.6565217391304348
                                                                                                                                                                                                                  RT_DIALOG0x1c9ea00x1eedataEnglishUnited States0.38866396761133604
                                                                                                                                                                                                                  RT_DIALOG0x1ca0900xe4dataEnglishUnited States0.6447368421052632
                                                                                                                                                                                                                  RT_DIALOG0x1ca1780xdadataEnglishUnited States0.6422018348623854
                                                                                                                                                                                                                  RT_DIALOG0x1ca2580x1eedataEnglishUnited States0.3866396761133603
                                                                                                                                                                                                                  RT_DIALOG0x1ca4480xe4dataEnglishUnited States0.6359649122807017
                                                                                                                                                                                                                  RT_DIALOG0x1ca5300xdadataEnglishUnited States0.6376146788990825
                                                                                                                                                                                                                  RT_DIALOG0x1ca6100x1f2dataEnglishUnited States0.39759036144578314
                                                                                                                                                                                                                  RT_DIALOG0x1ca8080xe8dataEnglishUnited States0.6508620689655172
                                                                                                                                                                                                                  RT_DIALOG0x1ca8f00xdedataEnglishUnited States0.6486486486486487
                                                                                                                                                                                                                  RT_DIALOG0x1ca9d00x202dataEnglishUnited States0.42217898832684825
                                                                                                                                                                                                                  RT_DIALOG0x1cabd80xf8dataEnglishUnited States0.6653225806451613
                                                                                                                                                                                                                  RT_DIALOG0x1cacd00xeedataEnglishUnited States0.6512605042016807
                                                                                                                                                                                                                  RT_GROUP_ICON0x1cadc00x102dataEnglishUnited States0.627906976744186
                                                                                                                                                                                                                  RT_VERSION0x1caec80x1e4dataEnglishUnited States0.49793388429752067
                                                                                                                                                                                                                  RT_MANIFEST0x1cb0b00x423XML 1.0 document, ASCII text, with very long lines (1059), with no line terminatorsEnglishUnited States0.5127478753541076

                                                                                                                                                                                                                  Imports

                                                                                                                                                                                                                  DLLImport
                                                                                                                                                                                                                  KERNEL32.dllSetEnvironmentVariableW, SetFileAttributesW, Sleep, GetTickCount, GetFileSize, GetModuleFileNameW, GetCurrentProcess, CopyFileW, SetCurrentDirectoryW, GetFileAttributesW, GetWindowsDirectoryW, GetTempPathW, GetCommandLineW, GetVersion, SetErrorMode, lstrlenW, lstrcpynW, GetDiskFreeSpaceW, ExitProcess, GetShortPathNameW, CreateThread, GetLastError, CreateDirectoryW, CreateProcessW, RemoveDirectoryW, lstrcmpiA, CreateFileW, GetTempFileNameW, WriteFile, lstrcpyA, MoveFileExW, lstrcatW, GetSystemDirectoryW, GetProcAddress, GetModuleHandleA, GetExitCodeProcess, WaitForSingleObject, lstrcmpiW, MoveFileW, GetFullPathNameW, SetFileTime, SearchPathW, CompareFileTime, lstrcmpW, CloseHandle, ExpandEnvironmentStringsW, GlobalFree, GlobalLock, GlobalUnlock, GlobalAlloc, FindFirstFileW, FindNextFileW, DeleteFileW, SetFilePointer, ReadFile, FindClose, lstrlenA, MulDiv, MultiByteToWideChar, WideCharToMultiByte, GetPrivateProfileStringW, WritePrivateProfileStringW, FreeLibrary, LoadLibraryExW, GetModuleHandleW
                                                                                                                                                                                                                  USER32.dllGetSystemMenu, SetClassLongW, EnableMenuItem, IsWindowEnabled, SetWindowPos, GetSysColor, GetWindowLongW, SetCursor, LoadCursorW, CheckDlgButton, GetMessagePos, LoadBitmapW, CallWindowProcW, IsWindowVisible, CloseClipboard, SetClipboardData, EmptyClipboard, OpenClipboard, ScreenToClient, GetWindowRect, GetDlgItem, GetSystemMetrics, SetDlgItemTextW, GetDlgItemTextW, MessageBoxIndirectW, CharPrevW, CharNextA, wsprintfA, DispatchMessageW, PeekMessageW, ReleaseDC, EnableWindow, InvalidateRect, SendMessageW, DefWindowProcW, BeginPaint, GetClientRect, FillRect, DrawTextW, EndDialog, RegisterClassW, SystemParametersInfoW, CreateWindowExW, GetClassInfoW, DialogBoxParamW, CharNextW, ExitWindowsEx, DestroyWindow, GetDC, SetTimer, SetWindowTextW, LoadImageW, SetForegroundWindow, ShowWindow, IsWindow, SetWindowLongW, FindWindowExW, TrackPopupMenu, AppendMenuW, CreatePopupMenu, EndPaint, CreateDialogParamW, SendMessageTimeoutW, wsprintfW, PostQuitMessage
                                                                                                                                                                                                                  GDI32.dllSelectObject, SetBkMode, CreateFontIndirectW, SetTextColor, DeleteObject, GetDeviceCaps, CreateBrushIndirect, SetBkColor
                                                                                                                                                                                                                  SHELL32.dllSHGetSpecialFolderLocation, ShellExecuteExW, SHGetPathFromIDListW, SHBrowseForFolderW, SHGetFileInfoW, SHFileOperationW
                                                                                                                                                                                                                  ADVAPI32.dllAdjustTokenPrivileges, RegCreateKeyExW, RegOpenKeyExW, SetFileSecurityW, OpenProcessToken, LookupPrivilegeValueW, RegEnumValueW, RegDeleteKeyW, RegDeleteValueW, RegCloseKey, RegSetValueExW, RegQueryValueExW, RegEnumKeyW
                                                                                                                                                                                                                  COMCTL32.dllImageList_Create, ImageList_AddMasked, ImageList_Destroy
                                                                                                                                                                                                                  ole32.dllOleUninitialize, OleInitialize, CoTaskMemFree, CoCreateInstance

                                                                                                                                                                                                                  Possible Origin

                                                                                                                                                                                                                  Language of compilation systemCountry where language is spokenMap
                                                                                                                                                                                                                  EnglishUnited States

                                                                                                                                                                                                                  Network Behavior

                                                                                                                                                                                                                  DNS Answers

                                                                                                                                                                                                                  TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
                                                                                                                                                                                                                  Nov 14, 2024 19:55:15.538739920 CET1.1.1.1192.168.2.60x29e3No error (0)shed.dual-low.s-part-0017.t-0009.t-msedge.nets-part-0017.t-0009.t-msedge.netCNAME (Canonical name)IN (0x0001)false
                                                                                                                                                                                                                  Nov 14, 2024 19:55:15.538739920 CET1.1.1.1192.168.2.60x29e3No error (0)s-part-0017.t-0009.t-msedge.net13.107.246.45A (IP address)IN (0x0001)false

                                                                                                                                                                                                                  Statistics

                                                                                                                                                                                                                  CPU Usage

                                                                                                                                                                                                                  Click to jump to process

                                                                                                                                                                                                                  Memory Usage

                                                                                                                                                                                                                  Click to jump to process

                                                                                                                                                                                                                  High Level Behavior Distribution

                                                                                                                                                                                                                  Click to dive into process behavior distribution

                                                                                                                                                                                                                  Behavior

                                                                                                                                                                                                                  Click to jump to process

                                                                                                                                                                                                                  System Behavior

                                                                                                                                                                                                                  General

                                                                                                                                                                                                                  Target ID:0
                                                                                                                                                                                                                  Start time:13:55:18
                                                                                                                                                                                                                  Start date:14/11/2024
                                                                                                                                                                                                                  Path:C:\Users\user\Desktop\cMqyGFCQHk.exe
                                                                                                                                                                                                                  Wow64 process (32bit):true
                                                                                                                                                                                                                  Commandline:"C:\Users\user\Desktop\cMqyGFCQHk.exe"
                                                                                                                                                                                                                  Imagebase:0x400000
                                                                                                                                                                                                                  File size:86'797'392 bytes
                                                                                                                                                                                                                  MD5 hash:B408E3DA98F0E457D627510165374DDD
                                                                                                                                                                                                                  Has elevated privileges:true
                                                                                                                                                                                                                  Has administrator privileges:true
                                                                                                                                                                                                                  Programmed in:C, C++ or other language
                                                                                                                                                                                                                  Reputation:low
                                                                                                                                                                                                                  Has exited:true

                                                                                                                                                                                                                  General

                                                                                                                                                                                                                  Target ID:2
                                                                                                                                                                                                                  Start time:13:55:18
                                                                                                                                                                                                                  Start date:14/11/2024
                                                                                                                                                                                                                  Path:C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                  Wow64 process (32bit):true
                                                                                                                                                                                                                  Commandline:"C:\Windows\system32\cmd.exe" /c tasklist /FI "USERNAME eq %USERNAME%" /FI "IMAGENAME eq Teams.exe" /FO csv | "C:\Windows\system32\find.exe" "Teams.exe"
                                                                                                                                                                                                                  Imagebase:0x1c0000
                                                                                                                                                                                                                  File size:236'544 bytes
                                                                                                                                                                                                                  MD5 hash:D0FCE3AFA6AA1D58CE9FA336CC2B675B
                                                                                                                                                                                                                  Has elevated privileges:true
                                                                                                                                                                                                                  Has administrator privileges:true
                                                                                                                                                                                                                  Programmed in:C, C++ or other language
                                                                                                                                                                                                                  Reputation:high
                                                                                                                                                                                                                  Has exited:true

                                                                                                                                                                                                                  General

                                                                                                                                                                                                                  Target ID:3
                                                                                                                                                                                                                  Start time:13:55:18
                                                                                                                                                                                                                  Start date:14/11/2024
                                                                                                                                                                                                                  Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                                  Wow64 process (32bit):false
                                                                                                                                                                                                                  Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                  Imagebase:0x7ff66e660000
                                                                                                                                                                                                                  File size:862'208 bytes
                                                                                                                                                                                                                  MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                                                                  Has elevated privileges:true
                                                                                                                                                                                                                  Has administrator privileges:true
                                                                                                                                                                                                                  Programmed in:C, C++ or other language
                                                                                                                                                                                                                  Reputation:high
                                                                                                                                                                                                                  Has exited:true

                                                                                                                                                                                                                  General

                                                                                                                                                                                                                  Target ID:4
                                                                                                                                                                                                                  Start time:13:55:18
                                                                                                                                                                                                                  Start date:14/11/2024
                                                                                                                                                                                                                  Path:C:\Windows\SysWOW64\tasklist.exe
                                                                                                                                                                                                                  Wow64 process (32bit):true
                                                                                                                                                                                                                  Commandline:tasklist /FI "USERNAME eq user" /FI "IMAGENAME eq Teams.exe" /FO csv
                                                                                                                                                                                                                  Imagebase:0xa00000
                                                                                                                                                                                                                  File size:79'360 bytes
                                                                                                                                                                                                                  MD5 hash:0A4448B31CE7F83CB7691A2657F330F1
                                                                                                                                                                                                                  Has elevated privileges:true
                                                                                                                                                                                                                  Has administrator privileges:true
                                                                                                                                                                                                                  Programmed in:C, C++ or other language
                                                                                                                                                                                                                  Reputation:high
                                                                                                                                                                                                                  Has exited:true

                                                                                                                                                                                                                  General

                                                                                                                                                                                                                  Target ID:5
                                                                                                                                                                                                                  Start time:13:55:19
                                                                                                                                                                                                                  Start date:14/11/2024
                                                                                                                                                                                                                  Path:C:\Windows\SysWOW64\find.exe
                                                                                                                                                                                                                  Wow64 process (32bit):true
                                                                                                                                                                                                                  Commandline:"C:\Windows\system32\find.exe" "Teams.exe"
                                                                                                                                                                                                                  Imagebase:0xf90000
                                                                                                                                                                                                                  File size:14'848 bytes
                                                                                                                                                                                                                  MD5 hash:15B158BC998EEF74CFDD27C44978AEA0
                                                                                                                                                                                                                  Has elevated privileges:true
                                                                                                                                                                                                                  Has administrator privileges:true
                                                                                                                                                                                                                  Programmed in:C, C++ or other language
                                                                                                                                                                                                                  Reputation:moderate
                                                                                                                                                                                                                  Has exited:true

                                                                                                                                                                                                                  General

                                                                                                                                                                                                                  Target ID:9
                                                                                                                                                                                                                  Start time:13:55:46
                                                                                                                                                                                                                  Start date:14/11/2024
                                                                                                                                                                                                                  Path:C:\Users\user\AppData\Local\Programs\Teams\Teams.exe
                                                                                                                                                                                                                  Wow64 process (32bit):false
                                                                                                                                                                                                                  Commandline:"C:\Users\user\AppData\Local\Programs\Teams\Teams.exe"
                                                                                                                                                                                                                  Imagebase:0x7ff746f70000
                                                                                                                                                                                                                  File size:188'819'968 bytes
                                                                                                                                                                                                                  MD5 hash:102326801694C938E466C8D96E4200BD
                                                                                                                                                                                                                  Has elevated privileges:false
                                                                                                                                                                                                                  Has administrator privileges:false
                                                                                                                                                                                                                  Programmed in:C, C++ or other language
                                                                                                                                                                                                                  Antivirus matches:
                                                                                                                                                                                                                  • Detection: 0%, ReversingLabs
                                                                                                                                                                                                                  Reputation:low
                                                                                                                                                                                                                  Has exited:false

                                                                                                                                                                                                                  General

                                                                                                                                                                                                                  Target ID:11
                                                                                                                                                                                                                  Start time:13:55:48
                                                                                                                                                                                                                  Start date:14/11/2024
                                                                                                                                                                                                                  Path:C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                  Wow64 process (32bit):false
                                                                                                                                                                                                                  Commandline:C:\Windows\system32\cmd.exe /d /s /c "powershell "$s=(New-Object -COM WScript.Shell).CreateShortcut('C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MyElectronApp.lnk');$s.TargetPath='C:\Users\user\AppData\Local\Programs\Teams\Teams.exe';$s.Save()""
                                                                                                                                                                                                                  Imagebase:0x7ff6d6740000
                                                                                                                                                                                                                  File size:289'792 bytes
                                                                                                                                                                                                                  MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                                                                                                                                                                                                  Has elevated privileges:false
                                                                                                                                                                                                                  Has administrator privileges:false
                                                                                                                                                                                                                  Programmed in:C, C++ or other language
                                                                                                                                                                                                                  Reputation:high
                                                                                                                                                                                                                  Has exited:true

                                                                                                                                                                                                                  General

                                                                                                                                                                                                                  Target ID:12
                                                                                                                                                                                                                  Start time:13:55:49
                                                                                                                                                                                                                  Start date:14/11/2024
                                                                                                                                                                                                                  Path:C:\Users\user\AppData\Local\Programs\Teams\Teams.exe
                                                                                                                                                                                                                  Wow64 process (32bit):false
                                                                                                                                                                                                                  Commandline:"C:\Users\user\AppData\Local\Programs\Teams\Teams.exe" --type=gpu-process --user-data-dir="C:\Users\user\AppData\Roaming\Teams" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=1804,i,4916229494749615140,4144486409714305981,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=1796 /prefetch:2
                                                                                                                                                                                                                  Imagebase:0x7ff746f70000
                                                                                                                                                                                                                  File size:188'819'968 bytes
                                                                                                                                                                                                                  MD5 hash:102326801694C938E466C8D96E4200BD
                                                                                                                                                                                                                  Has elevated privileges:false
                                                                                                                                                                                                                  Has administrator privileges:false
                                                                                                                                                                                                                  Programmed in:C, C++ or other language
                                                                                                                                                                                                                  Reputation:low
                                                                                                                                                                                                                  Has exited:false

                                                                                                                                                                                                                  General

                                                                                                                                                                                                                  Target ID:13
                                                                                                                                                                                                                  Start time:13:55:48
                                                                                                                                                                                                                  Start date:14/11/2024
                                                                                                                                                                                                                  Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                                  Wow64 process (32bit):false
                                                                                                                                                                                                                  Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                  Imagebase:0x7ff66e660000
                                                                                                                                                                                                                  File size:862'208 bytes
                                                                                                                                                                                                                  MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                                                                  Has elevated privileges:false
                                                                                                                                                                                                                  Has administrator privileges:false
                                                                                                                                                                                                                  Programmed in:C, C++ or other language
                                                                                                                                                                                                                  Reputation:high
                                                                                                                                                                                                                  Has exited:true

                                                                                                                                                                                                                  General

                                                                                                                                                                                                                  Target ID:14
                                                                                                                                                                                                                  Start time:13:55:48
                                                                                                                                                                                                                  Start date:14/11/2024
                                                                                                                                                                                                                  Path:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                  Wow64 process (32bit):false
                                                                                                                                                                                                                  Commandline:powershell "$s=(New-Object -COM WScript.Shell).CreateShortcut('C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MyElectronApp.lnk');$s.TargetPath='C:\Users\user\AppData\Local\Programs\Teams\Teams.exe';$s.Save()"
                                                                                                                                                                                                                  Imagebase:0x7ff6e3d50000
                                                                                                                                                                                                                  File size:452'608 bytes
                                                                                                                                                                                                                  MD5 hash:04029E121A0CFA5991749937DD22A1D9
                                                                                                                                                                                                                  Has elevated privileges:false
                                                                                                                                                                                                                  Has administrator privileges:false
                                                                                                                                                                                                                  Programmed in:C, C++ or other language
                                                                                                                                                                                                                  Reputation:high
                                                                                                                                                                                                                  Has exited:true

                                                                                                                                                                                                                  General

                                                                                                                                                                                                                  Target ID:15
                                                                                                                                                                                                                  Start time:13:55:52
                                                                                                                                                                                                                  Start date:14/11/2024
                                                                                                                                                                                                                  Path:C:\Users\user\AppData\Local\Programs\Teams\Teams.exe
                                                                                                                                                                                                                  Wow64 process (32bit):false
                                                                                                                                                                                                                  Commandline:"C:\Users\user\AppData\Local\Programs\Teams\Teams.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --user-data-dir="C:\Users\user\AppData\Roaming\Teams" --field-trial-handle=2464,i,4916229494749615140,4144486409714305981,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2416 /prefetch:3
                                                                                                                                                                                                                  Imagebase:0x7ff746f70000
                                                                                                                                                                                                                  File size:188'819'968 bytes
                                                                                                                                                                                                                  MD5 hash:102326801694C938E466C8D96E4200BD
                                                                                                                                                                                                                  Has elevated privileges:false
                                                                                                                                                                                                                  Has administrator privileges:false
                                                                                                                                                                                                                  Programmed in:C, C++ or other language
                                                                                                                                                                                                                  Has exited:false

                                                                                                                                                                                                                  General

                                                                                                                                                                                                                  Target ID:16
                                                                                                                                                                                                                  Start time:13:56:00
                                                                                                                                                                                                                  Start date:14/11/2024
                                                                                                                                                                                                                  Path:C:\Users\user\AppData\Local\Programs\Teams\Teams.exe
                                                                                                                                                                                                                  Wow64 process (32bit):false
                                                                                                                                                                                                                  Commandline:"C:\Users\user\AppData\Local\Programs\Teams\Teams.exe"
                                                                                                                                                                                                                  Imagebase:0x7ff746f70000
                                                                                                                                                                                                                  File size:188'819'968 bytes
                                                                                                                                                                                                                  MD5 hash:102326801694C938E466C8D96E4200BD
                                                                                                                                                                                                                  Has elevated privileges:false
                                                                                                                                                                                                                  Has administrator privileges:false
                                                                                                                                                                                                                  Programmed in:C, C++ or other language
                                                                                                                                                                                                                  Has exited:false

                                                                                                                                                                                                                  General

                                                                                                                                                                                                                  Target ID:17
                                                                                                                                                                                                                  Start time:13:56:02
                                                                                                                                                                                                                  Start date:14/11/2024
                                                                                                                                                                                                                  Path:C:\Users\user\AppData\Local\Programs\Teams\Teams.exe
                                                                                                                                                                                                                  Wow64 process (32bit):false
                                                                                                                                                                                                                  Commandline:"C:\Users\user\AppData\Local\Programs\Teams\Teams.exe" --type=gpu-process --user-data-dir="C:\Users\user\AppData\Roaming\Teams" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=1704,i,126123718397027599,14626746628952611418,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=1696 /prefetch:2
                                                                                                                                                                                                                  Imagebase:0x7ff746f70000
                                                                                                                                                                                                                  File size:188'819'968 bytes
                                                                                                                                                                                                                  MD5 hash:102326801694C938E466C8D96E4200BD
                                                                                                                                                                                                                  Has elevated privileges:false
                                                                                                                                                                                                                  Has administrator privileges:false
                                                                                                                                                                                                                  Programmed in:C, C++ or other language
                                                                                                                                                                                                                  Has exited:false

                                                                                                                                                                                                                  General

                                                                                                                                                                                                                  Target ID:18
                                                                                                                                                                                                                  Start time:13:56:01
                                                                                                                                                                                                                  Start date:14/11/2024
                                                                                                                                                                                                                  Path:C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                  Wow64 process (32bit):false
                                                                                                                                                                                                                  Commandline:C:\Windows\system32\cmd.exe /d /s /c "powershell "$s=(New-Object -COM WScript.Shell).CreateShortcut('C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MyElectronApp.lnk');$s.TargetPath='C:\Users\user\AppData\Local\Programs\Teams\Teams.exe';$s.Save()""
                                                                                                                                                                                                                  Imagebase:0x7ff6d6740000
                                                                                                                                                                                                                  File size:289'792 bytes
                                                                                                                                                                                                                  MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                                                                                                                                                                                                  Has elevated privileges:false
                                                                                                                                                                                                                  Has administrator privileges:false
                                                                                                                                                                                                                  Programmed in:C, C++ or other language
                                                                                                                                                                                                                  Has exited:true

                                                                                                                                                                                                                  General

                                                                                                                                                                                                                  Target ID:19
                                                                                                                                                                                                                  Start time:13:56:01
                                                                                                                                                                                                                  Start date:14/11/2024
                                                                                                                                                                                                                  Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                                  Wow64 process (32bit):false
                                                                                                                                                                                                                  Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                  Imagebase:0x7ff66e660000
                                                                                                                                                                                                                  File size:862'208 bytes
                                                                                                                                                                                                                  MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                                                                  Has elevated privileges:false
                                                                                                                                                                                                                  Has administrator privileges:false
                                                                                                                                                                                                                  Programmed in:C, C++ or other language
                                                                                                                                                                                                                  Has exited:true

                                                                                                                                                                                                                  General

                                                                                                                                                                                                                  Target ID:20
                                                                                                                                                                                                                  Start time:13:56:01
                                                                                                                                                                                                                  Start date:14/11/2024
                                                                                                                                                                                                                  Path:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                  Wow64 process (32bit):false
                                                                                                                                                                                                                  Commandline:powershell "$s=(New-Object -COM WScript.Shell).CreateShortcut('C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MyElectronApp.lnk');$s.TargetPath='C:\Users\user\AppData\Local\Programs\Teams\Teams.exe';$s.Save()"
                                                                                                                                                                                                                  Imagebase:0x7ff6e3d50000
                                                                                                                                                                                                                  File size:452'608 bytes
                                                                                                                                                                                                                  MD5 hash:04029E121A0CFA5991749937DD22A1D9
                                                                                                                                                                                                                  Has elevated privileges:false
                                                                                                                                                                                                                  Has administrator privileges:false
                                                                                                                                                                                                                  Programmed in:C, C++ or other language
                                                                                                                                                                                                                  Has exited:true

                                                                                                                                                                                                                  General

                                                                                                                                                                                                                  Target ID:21
                                                                                                                                                                                                                  Start time:13:56:03
                                                                                                                                                                                                                  Start date:14/11/2024
                                                                                                                                                                                                                  Path:C:\Users\user\AppData\Local\Programs\Teams\Teams.exe
                                                                                                                                                                                                                  Wow64 process (32bit):false
                                                                                                                                                                                                                  Commandline:"C:\Users\user\AppData\Local\Programs\Teams\Teams.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --user-data-dir="C:\Users\user\AppData\Roaming\Teams" --field-trial-handle=2428,i,126123718397027599,14626746628952611418,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2424 /prefetch:3
                                                                                                                                                                                                                  Imagebase:0x7ff746f70000
                                                                                                                                                                                                                  File size:188'819'968 bytes
                                                                                                                                                                                                                  MD5 hash:102326801694C938E466C8D96E4200BD
                                                                                                                                                                                                                  Has elevated privileges:false
                                                                                                                                                                                                                  Has administrator privileges:false
                                                                                                                                                                                                                  Programmed in:C, C++ or other language
                                                                                                                                                                                                                  Has exited:false

                                                                                                                                                                                                                  General

                                                                                                                                                                                                                  Target ID:24
                                                                                                                                                                                                                  Start time:13:57:48
                                                                                                                                                                                                                  Start date:14/11/2024
                                                                                                                                                                                                                  Path:C:\Users\user\AppData\Local\Programs\Teams\Teams.exe
                                                                                                                                                                                                                  Wow64 process (32bit):false
                                                                                                                                                                                                                  Commandline:"C:\Users\user\AppData\Local\Programs\Teams\Teams.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --user-data-dir="C:\Users\user\AppData\Roaming\Teams" --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=2548,i,4916229494749615140,4144486409714305981,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2544 /prefetch:8
                                                                                                                                                                                                                  Imagebase:0x7ff746f70000
                                                                                                                                                                                                                  File size:188'819'968 bytes
                                                                                                                                                                                                                  MD5 hash:102326801694C938E466C8D96E4200BD
                                                                                                                                                                                                                  Has elevated privileges:false
                                                                                                                                                                                                                  Has administrator privileges:false
                                                                                                                                                                                                                  Programmed in:C, C++ or other language
                                                                                                                                                                                                                  Has exited:true

                                                                                                                                                                                                                  General

                                                                                                                                                                                                                  Target ID:25
                                                                                                                                                                                                                  Start time:13:58:02
                                                                                                                                                                                                                  Start date:14/11/2024
                                                                                                                                                                                                                  Path:C:\Users\user\AppData\Local\Programs\Teams\Teams.exe
                                                                                                                                                                                                                  Wow64 process (32bit):false
                                                                                                                                                                                                                  Commandline:"C:\Users\user\AppData\Local\Programs\Teams\Teams.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --user-data-dir="C:\Users\user\AppData\Roaming\Teams" --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=1200,i,126123718397027599,14626746628952611418,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2484 /prefetch:8
                                                                                                                                                                                                                  Imagebase:0x7ff746f70000
                                                                                                                                                                                                                  File size:188'819'968 bytes
                                                                                                                                                                                                                  MD5 hash:102326801694C938E466C8D96E4200BD
                                                                                                                                                                                                                  Has elevated privileges:false
                                                                                                                                                                                                                  Has administrator privileges:false
                                                                                                                                                                                                                  Programmed in:C, C++ or other language
                                                                                                                                                                                                                  Has exited:true

                                                                                                                                                                                                                  Disassembly

                                                                                                                                                                                                                  Reset < >

                                                                                                                                                                                                                    Execution Graph

                                                                                                                                                                                                                    Execution Coverage:25.8%
                                                                                                                                                                                                                    Dynamic/Decrypted Code Coverage:0%
                                                                                                                                                                                                                    Signature Coverage:20.2%
                                                                                                                                                                                                                    Total number of Nodes:1333
                                                                                                                                                                                                                    Total number of Limit Nodes:33
                                                                                                                                                                                                                    execution_graph 2912 401941 2913 401943 2912->2913 2918 402c41 2913->2918 2919 402c4d 2918->2919 2960 4062dc 2919->2960 2922 401948 2924 4059cc 2922->2924 3002 405c97 2924->3002 2927 4059f4 DeleteFileW 2957 401951 2927->2957 2928 405a0b 2929 405b2b 2928->2929 3016 4062ba lstrcpynW 2928->3016 2929->2957 3045 4065fd FindFirstFileW 2929->3045 2931 405a31 2932 405a44 2931->2932 2933 405a37 lstrcatW 2931->2933 3018 405bdb lstrlenW 2932->3018 2934 405a4a 2933->2934 2937 405a5a lstrcatW 2934->2937 2939 405a65 lstrlenW FindFirstFileW 2934->2939 2937->2939 2939->2929 2949 405a87 2939->2949 2942 405984 5 API calls 2945 405b66 2942->2945 2944 405b0e FindNextFileW 2946 405b24 FindClose 2944->2946 2944->2949 2947 405b80 2945->2947 2948 405b6a 2945->2948 2946->2929 2951 405322 24 API calls 2947->2951 2952 405322 24 API calls 2948->2952 2948->2957 2949->2944 2953 4059cc 60 API calls 2949->2953 2955 405322 24 API calls 2949->2955 3017 4062ba lstrcpynW 2949->3017 3022 405984 2949->3022 3030 405322 2949->3030 3041 406080 MoveFileExW 2949->3041 2951->2957 2954 405b77 2952->2954 2953->2949 2956 406080 36 API calls 2954->2956 2955->2944 2956->2957 2973 4062e9 2960->2973 2961 406534 2962 402c6e 2961->2962 2993 4062ba lstrcpynW 2961->2993 2962->2922 2977 40654e 2962->2977 2964 406502 lstrlenW 2964->2973 2965 4062dc 10 API calls 2965->2964 2968 406417 GetSystemDirectoryW 2968->2973 2970 40642a GetWindowsDirectoryW 2970->2973 2971 40654e 5 API calls 2971->2973 2972 4064a5 lstrcatW 2972->2973 2973->2961 2973->2964 2973->2965 2973->2968 2973->2970 2973->2971 2973->2972 2974 40645e SHGetSpecialFolderLocation 2973->2974 2975 4062dc 10 API calls 2973->2975 2986 406188 2973->2986 2991 406201 wsprintfW 2973->2991 2992 4062ba lstrcpynW 2973->2992 2974->2973 2976 406476 SHGetPathFromIDListW CoTaskMemFree 2974->2976 2975->2973 2976->2973 2980 40655b 2977->2980 2978 4065d1 2979 4065d6 CharPrevW 2978->2979 2983 4065f7 2978->2983 2979->2978 2980->2978 2981 4065c4 CharNextW 2980->2981 2984 4065b0 CharNextW 2980->2984 2985 4065bf CharNextW 2980->2985 2998 405bbc 2980->2998 2981->2978 2981->2980 2983->2922 2984->2980 2985->2981 2994 406127 2986->2994 2989 4061ec 2989->2973 2990 4061bc RegQueryValueExW RegCloseKey 2990->2989 2991->2973 2992->2973 2993->2962 2995 406136 2994->2995 2996 40613a 2995->2996 2997 40613f RegOpenKeyExW 2995->2997 2996->2989 2996->2990 2997->2996 2999 405bc2 2998->2999 3000 405bd8 2999->3000 3001 405bc9 CharNextW 2999->3001 3000->2980 3001->2999 3051 4062ba lstrcpynW 3002->3051 3004 405ca8 3052 405c3a CharNextW CharNextW 3004->3052 3007 4059ec 3007->2927 3007->2928 3008 40654e 5 API calls 3011 405cbe 3008->3011 3009 405cef lstrlenW 3010 405cfa 3009->3010 3009->3011 3012 405b8f 3 API calls 3010->3012 3011->3007 3011->3009 3013 4065fd 2 API calls 3011->3013 3015 405bdb 2 API calls 3011->3015 3014 405cff GetFileAttributesW 3012->3014 3013->3011 3014->3007 3015->3009 3016->2931 3017->2949 3019 405be9 3018->3019 3020 405bfb 3019->3020 3021 405bef CharPrevW 3019->3021 3020->2934 3021->3019 3021->3020 3058 405d8b GetFileAttributesW 3022->3058 3025 4059b1 3025->2949 3026 4059a7 DeleteFileW 3028 4059ad 3026->3028 3027 40599f RemoveDirectoryW 3027->3028 3028->3025 3029 4059bd SetFileAttributesW 3028->3029 3029->3025 3031 40533d 3030->3031 3040 4053df 3030->3040 3032 405359 lstrlenW 3031->3032 3033 4062dc 17 API calls 3031->3033 3034 405382 3032->3034 3035 405367 lstrlenW 3032->3035 3033->3032 3037 405395 3034->3037 3038 405388 SetWindowTextW 3034->3038 3036 405379 lstrcatW 3035->3036 3035->3040 3036->3034 3039 40539b SendMessageW SendMessageW SendMessageW 3037->3039 3037->3040 3038->3037 3039->3040 3040->2949 3042 4060a1 3041->3042 3043 406094 3041->3043 3042->2949 3061 405f06 3043->3061 3046 406613 FindClose 3045->3046 3047 405b50 3045->3047 3046->3047 3047->2957 3048 405b8f lstrlenW CharPrevW 3047->3048 3049 405b5a 3048->3049 3050 405bab lstrcatW 3048->3050 3049->2942 3050->3049 3051->3004 3053 405c57 3052->3053 3056 405c69 3052->3056 3055 405c64 CharNextW 3053->3055 3053->3056 3054 405c8d 3054->3007 3054->3008 3055->3054 3056->3054 3057 405bbc CharNextW 3056->3057 3057->3056 3059 405990 3058->3059 3060 405d9d SetFileAttributesW 3058->3060 3059->3025 3059->3026 3059->3027 3060->3059 3062 405f36 3061->3062 3063 405f5c GetShortPathNameW 3061->3063 3088 405db0 GetFileAttributesW CreateFileW 3062->3088 3065 405f71 3063->3065 3066 40607b 3063->3066 3065->3066 3067 405f79 wsprintfA 3065->3067 3066->3042 3069 4062dc 17 API calls 3067->3069 3068 405f40 CloseHandle GetShortPathNameW 3068->3066 3070 405f54 3068->3070 3071 405fa1 3069->3071 3070->3063 3070->3066 3089 405db0 GetFileAttributesW CreateFileW 3071->3089 3073 405fae 3073->3066 3074 405fbd GetFileSize GlobalAlloc 3073->3074 3075 406074 CloseHandle 3074->3075 3076 405fdf 3074->3076 3075->3066 3090 405e33 ReadFile 3076->3090 3081 406012 3083 405d15 4 API calls 3081->3083 3082 405ffe lstrcpyA 3084 406020 3082->3084 3083->3084 3085 406057 SetFilePointer 3084->3085 3097 405e62 WriteFile 3085->3097 3088->3068 3089->3073 3091 405e51 3090->3091 3091->3075 3092 405d15 lstrlenA 3091->3092 3093 405d56 lstrlenA 3092->3093 3094 405d2f lstrcmpiA 3093->3094 3095 405d5e 3093->3095 3094->3095 3096 405d4d CharNextA 3094->3096 3095->3081 3095->3082 3096->3093 3098 405e80 GlobalFree 3097->3098 3098->3075 3099 4015c1 3100 402c41 17 API calls 3099->3100 3101 4015c8 3100->3101 3102 405c3a 4 API calls 3101->3102 3114 4015d1 3102->3114 3103 401631 3105 401663 3103->3105 3106 401636 3103->3106 3104 405bbc CharNextW 3104->3114 3108 401423 24 API calls 3105->3108 3126 401423 3106->3126 3116 40165b 3108->3116 3113 40164a SetCurrentDirectoryW 3113->3116 3114->3103 3114->3104 3115 401617 GetFileAttributesW 3114->3115 3118 40588b 3114->3118 3121 4057f1 CreateDirectoryW 3114->3121 3130 40586e CreateDirectoryW 3114->3130 3115->3114 3133 406694 GetModuleHandleA 3118->3133 3122 405842 GetLastError 3121->3122 3123 40583e 3121->3123 3122->3123 3124 405851 SetFileSecurityW 3122->3124 3123->3114 3124->3123 3125 405867 GetLastError 3124->3125 3125->3123 3127 405322 24 API calls 3126->3127 3128 401431 3127->3128 3129 4062ba lstrcpynW 3128->3129 3129->3113 3131 405882 GetLastError 3130->3131 3132 40587e 3130->3132 3131->3132 3132->3114 3134 4066b0 3133->3134 3135 4066ba GetProcAddress 3133->3135 3139 406624 GetSystemDirectoryW 3134->3139 3137 405892 3135->3137 3137->3114 3138 4066b6 3138->3135 3138->3137 3140 406646 wsprintfW LoadLibraryExW 3139->3140 3140->3138 3294 401e49 3295 402c1f 17 API calls 3294->3295 3296 401e4f 3295->3296 3297 402c1f 17 API calls 3296->3297 3298 401e5b 3297->3298 3299 401e72 EnableWindow 3298->3299 3300 401e67 ShowWindow 3298->3300 3301 402ac5 3299->3301 3300->3301 3756 40264a 3757 402c1f 17 API calls 3756->3757 3761 402659 3757->3761 3758 4026a3 ReadFile 3758->3761 3768 402796 3758->3768 3759 405e33 ReadFile 3759->3761 3761->3758 3761->3759 3762 4026e3 MultiByteToWideChar 3761->3762 3763 402798 3761->3763 3765 402709 SetFilePointer MultiByteToWideChar 3761->3765 3766 4027a9 3761->3766 3761->3768 3769 405e91 SetFilePointer 3761->3769 3762->3761 3778 406201 wsprintfW 3763->3778 3765->3761 3767 4027ca SetFilePointer 3766->3767 3766->3768 3767->3768 3770 405ead 3769->3770 3771 405ec5 3769->3771 3772 405e33 ReadFile 3770->3772 3771->3761 3773 405eb9 3772->3773 3773->3771 3774 405ef6 SetFilePointer 3773->3774 3775 405ece SetFilePointer 3773->3775 3774->3771 3775->3774 3776 405ed9 3775->3776 3777 405e62 WriteFile 3776->3777 3777->3771 3778->3768 3782 4016cc 3783 402c41 17 API calls 3782->3783 3784 4016d2 GetFullPathNameW 3783->3784 3785 4016ec 3784->3785 3791 40170e 3784->3791 3788 4065fd 2 API calls 3785->3788 3785->3791 3786 401723 GetShortPathNameW 3787 402ac5 3786->3787 3789 4016fe 3788->3789 3789->3791 3792 4062ba lstrcpynW 3789->3792 3791->3786 3791->3787 3792->3791 3793 40234e 3794 402c41 17 API calls 3793->3794 3795 40235d 3794->3795 3796 402c41 17 API calls 3795->3796 3797 402366 3796->3797 3798 402c41 17 API calls 3797->3798 3799 402370 GetPrivateProfileStringW 3798->3799 3582 4038d0 3583 4038e8 3582->3583 3584 4038da CloseHandle 3582->3584 3589 403915 3583->3589 3584->3583 3587 4059cc 67 API calls 3588 4038f9 3587->3588 3590 403923 3589->3590 3591 4038ed 3590->3591 3592 403928 FreeLibrary GlobalFree 3590->3592 3591->3587 3592->3591 3592->3592 3800 401b53 3801 402c41 17 API calls 3800->3801 3802 401b5a 3801->3802 3803 402c1f 17 API calls 3802->3803 3804 401b63 wsprintfW 3803->3804 3805 402ac5 3804->3805 3806 401956 3807 402c41 17 API calls 3806->3807 3808 40195d lstrlenW 3807->3808 3809 402592 3808->3809 3810 4014d7 3811 402c1f 17 API calls 3810->3811 3812 4014dd Sleep 3811->3812 3814 402ac5 3812->3814 3639 403d58 3640 403d70 3639->3640 3641 403eab 3639->3641 3640->3641 3642 403d7c 3640->3642 3643 403efc 3641->3643 3644 403ebc GetDlgItem GetDlgItem 3641->3644 3646 403d87 SetWindowPos 3642->3646 3647 403d9a 3642->3647 3645 403f56 3643->3645 3653 401389 2 API calls 3643->3653 3648 404231 18 API calls 3644->3648 3649 40427d SendMessageW 3645->3649 3670 403ea6 3645->3670 3646->3647 3650 403db7 3647->3650 3651 403d9f ShowWindow 3647->3651 3652 403ee6 SetClassLongW 3648->3652 3682 403f68 3649->3682 3654 403dd9 3650->3654 3655 403dbf DestroyWindow 3650->3655 3651->3650 3656 40140b 2 API calls 3652->3656 3657 403f2e 3653->3657 3658 403dde SetWindowLongW 3654->3658 3659 403def 3654->3659 3709 4041ba 3655->3709 3656->3643 3657->3645 3662 403f32 SendMessageW 3657->3662 3658->3670 3660 403e98 3659->3660 3661 403dfb GetDlgItem 3659->3661 3667 404298 8 API calls 3660->3667 3665 403e2b 3661->3665 3666 403e0e SendMessageW IsWindowEnabled 3661->3666 3662->3670 3663 40140b 2 API calls 3663->3682 3664 4041bc DestroyWindow EndDialog 3664->3709 3669 403e30 3665->3669 3672 403e38 3665->3672 3674 403e7f SendMessageW 3665->3674 3675 403e4b 3665->3675 3666->3665 3666->3670 3667->3670 3668 4041eb ShowWindow 3668->3670 3676 40420a SendMessageW 3669->3676 3671 4062dc 17 API calls 3671->3682 3672->3669 3672->3674 3673 404231 18 API calls 3673->3682 3674->3660 3678 403e53 3675->3678 3679 403e68 3675->3679 3677 403e66 3676->3677 3677->3660 3681 40140b 2 API calls 3678->3681 3680 40140b 2 API calls 3679->3680 3683 403e6f 3680->3683 3681->3669 3682->3663 3682->3664 3682->3670 3682->3671 3682->3673 3684 404231 18 API calls 3682->3684 3700 4040fc DestroyWindow 3682->3700 3683->3660 3683->3669 3685 403fe3 GetDlgItem 3684->3685 3686 404000 ShowWindow KiUserCallbackDispatcher 3685->3686 3687 403ff8 3685->3687 3710 404253 KiUserCallbackDispatcher 3686->3710 3687->3686 3689 40402a EnableWindow 3694 40403e 3689->3694 3690 404043 GetSystemMenu EnableMenuItem SendMessageW 3691 404073 SendMessageW 3690->3691 3690->3694 3691->3694 3693 403d39 18 API calls 3693->3694 3694->3690 3694->3693 3711 404266 SendMessageW 3694->3711 3712 4062ba lstrcpynW 3694->3712 3696 4040a2 lstrlenW 3697 4062dc 17 API calls 3696->3697 3698 4040b8 SetWindowTextW 3697->3698 3699 401389 2 API calls 3698->3699 3699->3682 3701 404116 CreateDialogParamW 3700->3701 3700->3709 3702 404149 3701->3702 3701->3709 3703 404231 18 API calls 3702->3703 3704 404154 GetDlgItem GetWindowRect ScreenToClient SetWindowPos 3703->3704 3705 401389 2 API calls 3704->3705 3706 40419a 3705->3706 3706->3670 3707 4041a2 ShowWindow 3706->3707 3708 40427d SendMessageW 3707->3708 3708->3709 3709->3668 3709->3670 3710->3689 3711->3694 3712->3696 3815 401f58 3816 402c41 17 API calls 3815->3816 3817 401f5f 3816->3817 3818 4065fd 2 API calls 3817->3818 3819 401f65 3818->3819 3821 401f76 3819->3821 3822 406201 wsprintfW 3819->3822 3822->3821 3713 402259 3714 402c41 17 API calls 3713->3714 3715 40225f 3714->3715 3716 402c41 17 API calls 3715->3716 3717 402268 3716->3717 3718 402c41 17 API calls 3717->3718 3719 402271 3718->3719 3720 4065fd 2 API calls 3719->3720 3721 40227a 3720->3721 3722 40228b lstrlenW lstrlenW 3721->3722 3723 40227e 3721->3723 3725 405322 24 API calls 3722->3725 3724 405322 24 API calls 3723->3724 3727 402286 3723->3727 3724->3727 3726 4022c9 SHFileOperationW 3725->3726 3726->3723 3726->3727 3823 4046db 3824 404711 3823->3824 3825 4046eb 3823->3825 3827 404298 8 API calls 3824->3827 3826 404231 18 API calls 3825->3826 3828 4046f8 SetDlgItemTextW 3826->3828 3829 40471d 3827->3829 3828->3824 3728 40175c 3729 402c41 17 API calls 3728->3729 3730 401763 3729->3730 3731 405ddf 2 API calls 3730->3731 3732 40176a 3731->3732 3733 405ddf 2 API calls 3732->3733 3733->3732 3830 401d5d GetDlgItem GetClientRect 3831 402c41 17 API calls 3830->3831 3832 401d8f LoadImageW SendMessageW 3831->3832 3833 402ac5 3832->3833 3834 401dad DeleteObject 3832->3834 3834->3833 3835 4022dd 3836 4022e4 3835->3836 3837 4022f7 3835->3837 3838 4062dc 17 API calls 3836->3838 3839 4022f1 3838->3839 3840 405920 MessageBoxIndirectW 3839->3840 3840->3837 3142 405461 3143 405482 GetDlgItem GetDlgItem GetDlgItem 3142->3143 3144 40560b 3142->3144 3188 404266 SendMessageW 3143->3188 3146 405614 GetDlgItem CreateThread CloseHandle 3144->3146 3147 40563c 3144->3147 3146->3147 3211 4053f5 OleInitialize 3146->3211 3149 405667 3147->3149 3150 405653 ShowWindow ShowWindow 3147->3150 3151 40568c 3147->3151 3148 4054f2 3155 4054f9 GetClientRect GetSystemMetrics SendMessageW SendMessageW 3148->3155 3152 405673 3149->3152 3153 4056c7 3149->3153 3193 404266 SendMessageW 3150->3193 3197 404298 3151->3197 3157 4056a1 ShowWindow 3152->3157 3158 40567b 3152->3158 3153->3151 3163 4056d5 SendMessageW 3153->3163 3161 405567 3155->3161 3162 40554b SendMessageW SendMessageW 3155->3162 3159 4056c1 3157->3159 3160 4056b3 3157->3160 3194 40420a 3158->3194 3166 40420a SendMessageW 3159->3166 3165 405322 24 API calls 3160->3165 3167 40557a 3161->3167 3168 40556c SendMessageW 3161->3168 3162->3161 3169 40569a 3163->3169 3170 4056ee CreatePopupMenu 3163->3170 3165->3159 3166->3153 3189 404231 3167->3189 3168->3167 3171 4062dc 17 API calls 3170->3171 3173 4056fe AppendMenuW 3171->3173 3175 40571b GetWindowRect 3173->3175 3176 40572e TrackPopupMenu 3173->3176 3174 40558a 3177 405593 ShowWindow 3174->3177 3178 4055c7 GetDlgItem SendMessageW 3174->3178 3175->3176 3176->3169 3180 405749 3176->3180 3181 4055b6 3177->3181 3182 4055a9 ShowWindow 3177->3182 3178->3169 3179 4055ee SendMessageW SendMessageW 3178->3179 3179->3169 3183 405765 SendMessageW 3180->3183 3192 404266 SendMessageW 3181->3192 3182->3181 3183->3183 3184 405782 OpenClipboard EmptyClipboard GlobalAlloc GlobalLock 3183->3184 3186 4057a7 SendMessageW 3184->3186 3186->3186 3187 4057d0 GlobalUnlock SetClipboardData CloseClipboard 3186->3187 3187->3169 3188->3148 3190 4062dc 17 API calls 3189->3190 3191 40423c SetDlgItemTextW 3190->3191 3191->3174 3192->3178 3193->3149 3195 404211 3194->3195 3196 404217 SendMessageW 3194->3196 3195->3196 3196->3151 3198 40435b 3197->3198 3199 4042b0 GetWindowLongW 3197->3199 3198->3169 3199->3198 3200 4042c5 3199->3200 3200->3198 3201 4042f2 GetSysColor 3200->3201 3202 4042f5 3200->3202 3201->3202 3203 404305 SetBkMode 3202->3203 3204 4042fb SetTextColor 3202->3204 3205 404323 3203->3205 3206 40431d GetSysColor 3203->3206 3204->3203 3207 404334 3205->3207 3208 40432a SetBkColor 3205->3208 3206->3205 3207->3198 3209 404347 DeleteObject 3207->3209 3210 40434e CreateBrushIndirect 3207->3210 3208->3207 3209->3210 3210->3198 3218 40427d 3211->3218 3213 405418 3217 40543f 3213->3217 3221 401389 3213->3221 3214 40427d SendMessageW 3215 405451 CoUninitialize 3214->3215 3217->3214 3219 404295 3218->3219 3220 404286 SendMessageW 3218->3220 3219->3213 3220->3219 3223 401390 3221->3223 3222 4013fe 3222->3213 3223->3222 3224 4013cb MulDiv SendMessageW 3223->3224 3224->3223 3841 401563 3842 402a6b 3841->3842 3845 406201 wsprintfW 3842->3845 3844 402a70 3845->3844 3225 4023e4 3226 402c41 17 API calls 3225->3226 3227 4023f6 3226->3227 3228 402c41 17 API calls 3227->3228 3229 402400 3228->3229 3242 402cd1 3229->3242 3232 402ac5 3233 402438 3234 402444 3233->3234 3246 402c1f 3233->3246 3237 402463 RegSetValueExW 3234->3237 3249 403116 3234->3249 3235 402c41 17 API calls 3238 40242e lstrlenW 3235->3238 3240 402479 RegCloseKey 3237->3240 3238->3233 3240->3232 3243 402cec 3242->3243 3269 406155 3243->3269 3247 4062dc 17 API calls 3246->3247 3248 402c34 3247->3248 3248->3234 3250 40312f 3249->3250 3251 40315d 3250->3251 3276 403347 SetFilePointer 3250->3276 3273 403331 3251->3273 3255 4032ca 3257 40330c 3255->3257 3262 4032ce 3255->3262 3256 40317a GetTickCount 3258 4032b4 3256->3258 3265 4031c9 3256->3265 3260 403331 ReadFile 3257->3260 3258->3237 3259 403331 ReadFile 3259->3265 3260->3258 3261 403331 ReadFile 3261->3262 3262->3258 3262->3261 3263 405e62 WriteFile 3262->3263 3263->3262 3264 40321f GetTickCount 3264->3265 3265->3258 3265->3259 3265->3264 3266 403244 MulDiv wsprintfW 3265->3266 3268 405e62 WriteFile 3265->3268 3267 405322 24 API calls 3266->3267 3267->3265 3268->3265 3270 406164 3269->3270 3271 402410 3270->3271 3272 40616f RegCreateKeyExW 3270->3272 3271->3232 3271->3233 3271->3235 3272->3271 3274 405e33 ReadFile 3273->3274 3275 403168 3274->3275 3275->3255 3275->3256 3275->3258 3276->3251 3846 404367 lstrcpynW lstrlenW 3847 401968 3848 402c1f 17 API calls 3847->3848 3849 40196f 3848->3849 3850 402c1f 17 API calls 3849->3850 3851 40197c 3850->3851 3852 402c41 17 API calls 3851->3852 3853 401993 lstrlenW 3852->3853 3854 4019a4 3853->3854 3855 4019e5 3854->3855 3859 4062ba lstrcpynW 3854->3859 3857 4019d5 3857->3855 3858 4019da lstrlenW 3857->3858 3858->3855 3859->3857 3860 402868 3861 402c41 17 API calls 3860->3861 3862 40286f FindFirstFileW 3861->3862 3863 402882 3862->3863 3864 402897 3862->3864 3868 406201 wsprintfW 3864->3868 3866 4028a0 3869 4062ba lstrcpynW 3866->3869 3868->3866 3869->3863 3870 403968 3871 403973 3870->3871 3872 403977 3871->3872 3873 40397a GlobalAlloc 3871->3873 3873->3872 3874 40166a 3875 402c41 17 API calls 3874->3875 3876 401670 3875->3876 3877 4065fd 2 API calls 3876->3877 3878 401676 3877->3878 3302 40176f 3303 402c41 17 API calls 3302->3303 3304 401776 3303->3304 3305 401796 3304->3305 3306 40179e 3304->3306 3341 4062ba lstrcpynW 3305->3341 3342 4062ba lstrcpynW 3306->3342 3309 40179c 3313 40654e 5 API calls 3309->3313 3310 4017a9 3311 405b8f 3 API calls 3310->3311 3312 4017af lstrcatW 3311->3312 3312->3309 3331 4017bb 3313->3331 3314 4065fd 2 API calls 3314->3331 3315 405d8b 2 API calls 3315->3331 3317 4017cd CompareFileTime 3317->3331 3318 40188d 3320 405322 24 API calls 3318->3320 3319 401864 3321 405322 24 API calls 3319->3321 3330 401879 3319->3330 3322 401897 3320->3322 3321->3330 3323 403116 31 API calls 3322->3323 3325 4018aa 3323->3325 3324 4062ba lstrcpynW 3324->3331 3326 4018be SetFileTime 3325->3326 3328 4018d0 CloseHandle 3325->3328 3326->3328 3327 4062dc 17 API calls 3327->3331 3329 4018e1 3328->3329 3328->3330 3332 4018e6 3329->3332 3333 4018f9 3329->3333 3331->3314 3331->3315 3331->3317 3331->3318 3331->3319 3331->3324 3331->3327 3340 405db0 GetFileAttributesW CreateFileW 3331->3340 3343 405920 3331->3343 3334 4062dc 17 API calls 3332->3334 3335 4062dc 17 API calls 3333->3335 3336 4018ee lstrcatW 3334->3336 3337 401901 3335->3337 3336->3337 3339 405920 MessageBoxIndirectW 3337->3339 3339->3330 3340->3331 3341->3309 3342->3310 3344 405935 3343->3344 3345 405981 3344->3345 3346 405949 MessageBoxIndirectW 3344->3346 3345->3331 3346->3345 3879 4027ef 3880 4027f6 3879->3880 3883 402a70 3879->3883 3881 402c1f 17 API calls 3880->3881 3882 4027fd 3881->3882 3884 40280c SetFilePointer 3882->3884 3884->3883 3885 40281c 3884->3885 3887 406201 wsprintfW 3885->3887 3887->3883 3888 4043f0 3889 404408 3888->3889 3893 404522 3888->3893 3894 404231 18 API calls 3889->3894 3890 40458c 3891 404656 3890->3891 3892 404596 GetDlgItem 3890->3892 3899 404298 8 API calls 3891->3899 3895 4045b0 3892->3895 3896 404617 3892->3896 3893->3890 3893->3891 3897 40455d GetDlgItem SendMessageW 3893->3897 3898 40446f 3894->3898 3895->3896 3902 4045d6 SendMessageW LoadCursorW SetCursor 3895->3902 3896->3891 3903 404629 3896->3903 3921 404253 KiUserCallbackDispatcher 3897->3921 3901 404231 18 API calls 3898->3901 3909 404651 3899->3909 3905 40447c CheckDlgButton 3901->3905 3925 40469f 3902->3925 3907 40463f 3903->3907 3908 40462f SendMessageW 3903->3908 3904 404587 3922 40467b 3904->3922 3919 404253 KiUserCallbackDispatcher 3905->3919 3907->3909 3910 404645 SendMessageW 3907->3910 3908->3907 3910->3909 3914 40449a GetDlgItem 3920 404266 SendMessageW 3914->3920 3916 4044b0 SendMessageW 3917 4044d6 SendMessageW SendMessageW lstrlenW SendMessageW SendMessageW 3916->3917 3918 4044cd GetSysColor 3916->3918 3917->3909 3918->3917 3919->3914 3920->3916 3921->3904 3923 404689 3922->3923 3924 40468e SendMessageW 3922->3924 3923->3924 3924->3890 3928 4058e6 ShellExecuteExW 3925->3928 3927 404605 LoadCursorW SetCursor 3927->3896 3928->3927 3929 401a72 3930 402c1f 17 API calls 3929->3930 3931 401a7b 3930->3931 3932 402c1f 17 API calls 3931->3932 3933 401a20 3932->3933 3934 401573 3935 401583 ShowWindow 3934->3935 3936 40158c 3934->3936 3935->3936 3937 40159a ShowWindow 3936->3937 3938 402ac5 3936->3938 3937->3938 3939 402df3 3940 402e05 SetTimer 3939->3940 3941 402e1e 3939->3941 3940->3941 3942 402e73 3941->3942 3943 402e38 MulDiv wsprintfW SetWindowTextW SetDlgItemTextW 3941->3943 3943->3942 3944 401cf3 3945 402c1f 17 API calls 3944->3945 3946 401cf9 IsWindow 3945->3946 3947 401a20 3946->3947 3948 4014f5 SetForegroundWindow 3949 402ac5 3948->3949 3950 402576 3951 402c41 17 API calls 3950->3951 3952 40257d 3951->3952 3955 405db0 GetFileAttributesW CreateFileW 3952->3955 3954 402589 3955->3954 3616 401b77 3617 401bc8 3616->3617 3619 401b84 3616->3619 3620 401bf2 GlobalAlloc 3617->3620 3621 401bcd 3617->3621 3618 4022e4 3623 4062dc 17 API calls 3618->3623 3619->3618 3625 401b9b 3619->3625 3622 4062dc 17 API calls 3620->3622 3631 401c0d 3621->3631 3635 4062ba lstrcpynW 3621->3635 3622->3631 3624 4022f1 3623->3624 3629 405920 MessageBoxIndirectW 3624->3629 3636 4062ba lstrcpynW 3625->3636 3628 401bdf GlobalFree 3628->3631 3629->3631 3630 401baa 3637 4062ba lstrcpynW 3630->3637 3633 401bb9 3638 4062ba lstrcpynW 3633->3638 3635->3628 3636->3630 3637->3633 3638->3631 3956 404a78 3957 404aa4 3956->3957 3958 404a88 3956->3958 3960 404ad7 3957->3960 3961 404aaa SHGetPathFromIDListW 3957->3961 3967 405904 GetDlgItemTextW 3958->3967 3963 404ac1 SendMessageW 3961->3963 3964 404aba 3961->3964 3962 404a95 SendMessageW 3962->3957 3963->3960 3966 40140b 2 API calls 3964->3966 3966->3963 3967->3962 3968 4024f8 3969 402c81 17 API calls 3968->3969 3970 402502 3969->3970 3971 402c1f 17 API calls 3970->3971 3972 40250b 3971->3972 3973 402533 RegEnumValueW 3972->3973 3974 402527 RegEnumKeyW 3972->3974 3976 40288b 3972->3976 3975 402548 RegCloseKey 3973->3975 3974->3975 3975->3976 3978 40167b 3979 402c41 17 API calls 3978->3979 3980 401682 3979->3980 3981 402c41 17 API calls 3980->3981 3982 40168b 3981->3982 3983 402c41 17 API calls 3982->3983 3984 401694 MoveFileW 3983->3984 3985 4016a7 3984->3985 3991 4016a0 3984->3991 3987 4065fd 2 API calls 3985->3987 3989 402250 3985->3989 3986 401423 24 API calls 3986->3989 3988 4016b6 3987->3988 3988->3989 3990 406080 36 API calls 3988->3990 3990->3991 3991->3986 3992 401e7d 3993 402c41 17 API calls 3992->3993 3994 401e83 3993->3994 3995 402c41 17 API calls 3994->3995 3996 401e8c 3995->3996 3997 402c41 17 API calls 3996->3997 3998 401e95 3997->3998 3999 402c41 17 API calls 3998->3999 4000 401e9e 3999->4000 4001 401423 24 API calls 4000->4001 4002 401ea5 4001->4002 4009 4058e6 ShellExecuteExW 4002->4009 4004 401ee7 4007 40288b 4004->4007 4010 406745 WaitForSingleObject 4004->4010 4006 401f01 CloseHandle 4006->4007 4009->4004 4011 40675f 4010->4011 4012 406771 GetExitCodeProcess 4011->4012 4013 4066d0 2 API calls 4011->4013 4012->4006 4014 406766 WaitForSingleObject 4013->4014 4014->4011 4015 4019ff 4016 402c41 17 API calls 4015->4016 4017 401a06 4016->4017 4018 402c41 17 API calls 4017->4018 4019 401a0f 4018->4019 4020 401a16 lstrcmpiW 4019->4020 4021 401a28 lstrcmpW 4019->4021 4022 401a1c 4020->4022 4021->4022 4023 401000 4024 401037 BeginPaint GetClientRect 4023->4024 4025 40100c DefWindowProcW 4023->4025 4027 4010f3 4024->4027 4028 401179 4025->4028 4029 401073 CreateBrushIndirect FillRect DeleteObject 4027->4029 4030 4010fc 4027->4030 4029->4027 4031 401102 CreateFontIndirectW 4030->4031 4032 401167 EndPaint 4030->4032 4031->4032 4033 401112 6 API calls 4031->4033 4032->4028 4033->4032 4034 401503 4035 40150b 4034->4035 4037 40151e 4034->4037 4036 402c1f 17 API calls 4035->4036 4036->4037 3277 402484 3288 402c81 3277->3288 3280 402c41 17 API calls 3281 402497 3280->3281 3282 4024a2 RegQueryValueExW 3281->3282 3283 40288b 3281->3283 3284 4024c2 3282->3284 3285 4024c8 RegCloseKey 3282->3285 3284->3285 3293 406201 wsprintfW 3284->3293 3285->3283 3289 402c41 17 API calls 3288->3289 3290 402c98 3289->3290 3291 406127 RegOpenKeyExW 3290->3291 3292 40248e 3291->3292 3292->3280 3293->3285 4038 402104 4039 402c41 17 API calls 4038->4039 4040 40210b 4039->4040 4041 402c41 17 API calls 4040->4041 4042 402115 4041->4042 4043 402c41 17 API calls 4042->4043 4044 40211f 4043->4044 4045 402c41 17 API calls 4044->4045 4046 402129 4045->4046 4047 402c41 17 API calls 4046->4047 4049 402133 4047->4049 4048 402172 CoCreateInstance 4053 402191 4048->4053 4049->4048 4050 402c41 17 API calls 4049->4050 4050->4048 4051 401423 24 API calls 4052 402250 4051->4052 4053->4051 4053->4052 4054 401f06 4055 402c41 17 API calls 4054->4055 4056 401f0c 4055->4056 4057 405322 24 API calls 4056->4057 4058 401f16 4057->4058 4059 4058a3 2 API calls 4058->4059 4060 401f1c 4059->4060 4061 401f3f CloseHandle 4060->4061 4062 40288b 4060->4062 4063 406745 5 API calls 4060->4063 4061->4062 4065 401f31 4063->4065 4065->4061 4067 406201 wsprintfW 4065->4067 4067->4061 4068 40190c 4069 401943 4068->4069 4070 402c41 17 API calls 4069->4070 4071 401948 4070->4071 4072 4059cc 67 API calls 4071->4072 4073 401951 4072->4073 4074 40230c 4075 402314 4074->4075 4077 40231a 4074->4077 4076 402c41 17 API calls 4075->4076 4076->4077 4078 402328 4077->4078 4080 402c41 17 API calls 4077->4080 4079 402336 4078->4079 4081 402c41 17 API calls 4078->4081 4082 402c41 17 API calls 4079->4082 4080->4078 4081->4079 4083 40233f WritePrivateProfileStringW 4082->4083 4084 401f8c 4085 402c41 17 API calls 4084->4085 4086 401f93 4085->4086 4087 406694 5 API calls 4086->4087 4088 401fa2 4087->4088 4089 402026 4088->4089 4090 401fbe GlobalAlloc 4088->4090 4090->4089 4091 401fd2 4090->4091 4092 406694 5 API calls 4091->4092 4093 401fd9 4092->4093 4094 406694 5 API calls 4093->4094 4095 401fe3 4094->4095 4095->4089 4099 406201 wsprintfW 4095->4099 4097 402018 4100 406201 wsprintfW 4097->4100 4099->4097 4100->4089 4101 40238e 4102 4023c1 4101->4102 4103 402396 4101->4103 4105 402c41 17 API calls 4102->4105 4104 402c81 17 API calls 4103->4104 4107 40239d 4104->4107 4106 4023c8 4105->4106 4112 402cff 4106->4112 4109 4023d5 4107->4109 4110 402c41 17 API calls 4107->4110 4111 4023ae RegDeleteValueW RegCloseKey 4110->4111 4111->4109 4113 402d13 4112->4113 4115 402d0c 4112->4115 4113->4115 4116 402d44 4113->4116 4115->4109 4117 406127 RegOpenKeyExW 4116->4117 4118 402d72 4117->4118 4119 402d98 RegEnumKeyW 4118->4119 4120 402daf RegCloseKey 4118->4120 4121 402dd0 RegCloseKey 4118->4121 4123 402d44 6 API calls 4118->4123 4126 402dc3 4118->4126 4119->4118 4119->4120 4122 406694 5 API calls 4120->4122 4121->4126 4124 402dbf 4122->4124 4123->4118 4125 402de0 RegDeleteKeyW 4124->4125 4124->4126 4125->4126 4126->4115 3347 40338f SetErrorMode GetVersion 3348 4033ce 3347->3348 3349 4033d4 3347->3349 3350 406694 5 API calls 3348->3350 3351 406624 3 API calls 3349->3351 3350->3349 3352 4033ea lstrlenA 3351->3352 3352->3349 3353 4033fa 3352->3353 3354 406694 5 API calls 3353->3354 3355 403401 3354->3355 3356 406694 5 API calls 3355->3356 3357 403408 3356->3357 3358 406694 5 API calls 3357->3358 3359 403414 #17 OleInitialize SHGetFileInfoW 3358->3359 3437 4062ba lstrcpynW 3359->3437 3362 403460 GetCommandLineW 3438 4062ba lstrcpynW 3362->3438 3364 403472 3365 405bbc CharNextW 3364->3365 3366 403497 CharNextW 3365->3366 3367 4035c1 GetTempPathW 3366->3367 3378 4034b0 3366->3378 3439 40335e 3367->3439 3369 4035d9 3370 403633 DeleteFileW 3369->3370 3371 4035dd GetWindowsDirectoryW lstrcatW 3369->3371 3449 402edd GetTickCount GetModuleFileNameW 3370->3449 3372 40335e 12 API calls 3371->3372 3375 4035f9 3372->3375 3373 405bbc CharNextW 3373->3378 3375->3370 3377 4035fd GetTempPathW lstrcatW SetEnvironmentVariableW SetEnvironmentVariableW 3375->3377 3376 403647 3379 4036fe ExitProcess CoUninitialize 3376->3379 3388 405bbc CharNextW 3376->3388 3420 4036ea 3376->3420 3380 40335e 12 API calls 3377->3380 3378->3373 3381 4035ac 3378->3381 3382 4035aa 3378->3382 3383 403834 3379->3383 3384 403714 3379->3384 3386 40362b 3380->3386 3533 4062ba lstrcpynW 3381->3533 3382->3367 3385 40383c GetCurrentProcess OpenProcessToken 3383->3385 3395 4038b8 ExitProcess 3383->3395 3390 405920 MessageBoxIndirectW 3384->3390 3392 403854 LookupPrivilegeValueW AdjustTokenPrivileges 3385->3392 3393 403888 3385->3393 3386->3370 3386->3379 3404 403666 3388->3404 3391 403722 ExitProcess 3390->3391 3392->3393 3397 406694 5 API calls 3393->3397 3394 4036fa 3394->3379 3400 40388f 3397->3400 3398 4036c4 3402 405c97 18 API calls 3398->3402 3399 40372a 3401 40588b 5 API calls 3399->3401 3403 4038a4 ExitWindowsEx 3400->3403 3407 4038b1 3400->3407 3405 40372f lstrcatW 3401->3405 3406 4036d0 3402->3406 3403->3395 3403->3407 3404->3398 3404->3399 3408 403740 lstrcatW 3405->3408 3409 40374b lstrcatW lstrcmpiW 3405->3409 3406->3379 3534 4062ba lstrcpynW 3406->3534 3541 40140b 3407->3541 3408->3409 3409->3379 3411 403767 3409->3411 3413 403773 3411->3413 3414 40376c 3411->3414 3418 40586e 2 API calls 3413->3418 3416 4057f1 4 API calls 3414->3416 3415 4036df 3535 4062ba lstrcpynW 3415->3535 3419 403771 3416->3419 3421 403778 SetCurrentDirectoryW 3418->3421 3419->3421 3477 4039aa 3420->3477 3422 403793 3421->3422 3423 403788 3421->3423 3537 4062ba lstrcpynW 3422->3537 3536 4062ba lstrcpynW 3423->3536 3426 4062dc 17 API calls 3427 4037d2 DeleteFileW 3426->3427 3428 4037df CopyFileW 3427->3428 3434 4037a1 3427->3434 3428->3434 3429 403828 3430 406080 36 API calls 3429->3430 3432 40382f 3430->3432 3431 406080 36 API calls 3431->3434 3432->3379 3433 4062dc 17 API calls 3433->3434 3434->3426 3434->3429 3434->3431 3434->3433 3436 403813 CloseHandle 3434->3436 3538 4058a3 CreateProcessW 3434->3538 3436->3434 3437->3362 3438->3364 3440 40654e 5 API calls 3439->3440 3442 40336a 3440->3442 3441 403374 3441->3369 3442->3441 3443 405b8f 3 API calls 3442->3443 3444 40337c 3443->3444 3445 40586e 2 API calls 3444->3445 3446 403382 3445->3446 3544 405ddf 3446->3544 3548 405db0 GetFileAttributesW CreateFileW 3449->3548 3451 402f1d 3476 402f2d 3451->3476 3549 4062ba lstrcpynW 3451->3549 3453 402f43 3454 405bdb 2 API calls 3453->3454 3455 402f49 3454->3455 3550 4062ba lstrcpynW 3455->3550 3457 402f54 GetFileSize 3458 403050 3457->3458 3475 402f6b 3457->3475 3551 402e79 3458->3551 3460 403059 3462 403089 GlobalAlloc 3460->3462 3460->3476 3563 403347 SetFilePointer 3460->3563 3461 403331 ReadFile 3461->3475 3562 403347 SetFilePointer 3462->3562 3464 4030bc 3466 402e79 6 API calls 3464->3466 3466->3476 3467 403072 3469 403331 ReadFile 3467->3469 3468 4030a4 3470 403116 31 API calls 3468->3470 3471 40307d 3469->3471 3473 4030b0 3470->3473 3471->3462 3471->3476 3472 402e79 6 API calls 3472->3475 3473->3473 3474 4030ed SetFilePointer 3473->3474 3473->3476 3474->3476 3475->3458 3475->3461 3475->3464 3475->3472 3475->3476 3476->3376 3478 406694 5 API calls 3477->3478 3479 4039be 3478->3479 3480 4039c4 3479->3480 3481 4039d6 3479->3481 3576 406201 wsprintfW 3480->3576 3482 406188 3 API calls 3481->3482 3483 403a06 3482->3483 3485 403a25 lstrcatW 3483->3485 3487 406188 3 API calls 3483->3487 3486 4039d4 3485->3486 3568 403c80 3486->3568 3487->3485 3490 405c97 18 API calls 3491 403a57 3490->3491 3492 403aeb 3491->3492 3494 406188 3 API calls 3491->3494 3493 405c97 18 API calls 3492->3493 3495 403af1 3493->3495 3496 403a89 3494->3496 3497 403b01 LoadImageW 3495->3497 3498 4062dc 17 API calls 3495->3498 3496->3492 3501 403aaa lstrlenW 3496->3501 3504 405bbc CharNextW 3496->3504 3499 403ba7 3497->3499 3500 403b28 RegisterClassW 3497->3500 3498->3497 3503 40140b 2 API calls 3499->3503 3502 403b5e SystemParametersInfoW CreateWindowExW 3500->3502 3532 403bb1 3500->3532 3505 403ab8 lstrcmpiW 3501->3505 3506 403ade 3501->3506 3502->3499 3507 403bad 3503->3507 3508 403aa7 3504->3508 3505->3506 3509 403ac8 GetFileAttributesW 3505->3509 3510 405b8f 3 API calls 3506->3510 3512 403c80 18 API calls 3507->3512 3507->3532 3508->3501 3511 403ad4 3509->3511 3513 403ae4 3510->3513 3511->3506 3515 405bdb 2 API calls 3511->3515 3516 403bbe 3512->3516 3577 4062ba lstrcpynW 3513->3577 3515->3506 3517 403bca ShowWindow 3516->3517 3518 403c4d 3516->3518 3519 406624 3 API calls 3517->3519 3520 4053f5 5 API calls 3518->3520 3521 403be2 3519->3521 3522 403c53 3520->3522 3523 403bf0 GetClassInfoW 3521->3523 3526 406624 3 API calls 3521->3526 3524 403c57 3522->3524 3525 403c6f 3522->3525 3528 403c04 GetClassInfoW RegisterClassW 3523->3528 3529 403c1a DialogBoxParamW 3523->3529 3530 40140b 2 API calls 3524->3530 3524->3532 3527 40140b 2 API calls 3525->3527 3526->3523 3527->3532 3528->3529 3531 40140b 2 API calls 3529->3531 3530->3532 3531->3532 3532->3394 3533->3382 3534->3415 3535->3420 3536->3422 3537->3434 3539 4058e2 3538->3539 3540 4058d6 CloseHandle 3538->3540 3539->3434 3540->3539 3542 401389 2 API calls 3541->3542 3543 401420 3542->3543 3543->3395 3545 405dec GetTickCount GetTempFileNameW 3544->3545 3546 405e22 3545->3546 3547 40338d 3545->3547 3546->3545 3546->3547 3547->3369 3548->3451 3549->3453 3550->3457 3552 402e82 3551->3552 3553 402e9a 3551->3553 3554 402e92 3552->3554 3555 402e8b DestroyWindow 3552->3555 3556 402ea2 3553->3556 3557 402eaa GetTickCount 3553->3557 3554->3460 3555->3554 3564 4066d0 3556->3564 3559 402eb8 CreateDialogParamW ShowWindow 3557->3559 3560 402edb 3557->3560 3559->3560 3560->3460 3562->3468 3563->3467 3565 4066ed PeekMessageW 3564->3565 3566 4066e3 DispatchMessageW 3565->3566 3567 402ea8 3565->3567 3566->3565 3567->3460 3569 403c94 3568->3569 3578 406201 wsprintfW 3569->3578 3571 403d05 3579 403d39 3571->3579 3573 403d0a 3574 403a35 3573->3574 3575 4062dc 17 API calls 3573->3575 3574->3490 3575->3573 3576->3486 3577->3492 3578->3571 3580 4062dc 17 API calls 3579->3580 3581 403d47 SetWindowTextW 3580->3581 3581->3573 4127 40190f 4128 402c41 17 API calls 4127->4128 4129 401916 4128->4129 4130 405920 MessageBoxIndirectW 4129->4130 4131 40191f 4130->4131 4132 401491 4133 405322 24 API calls 4132->4133 4134 401498 4133->4134 4135 401d14 4136 402c1f 17 API calls 4135->4136 4137 401d1b 4136->4137 4138 402c1f 17 API calls 4137->4138 4139 401d27 GetDlgItem 4138->4139 4140 402592 4139->4140 4141 405296 4142 4052a6 4141->4142 4143 4052ba 4141->4143 4145 4052ac 4142->4145 4153 405303 4142->4153 4144 4052c2 IsWindowVisible 4143->4144 4147 4052d9 4143->4147 4146 4052cf 4144->4146 4144->4153 4149 40427d SendMessageW 4145->4149 4154 404bec SendMessageW 4146->4154 4148 405308 CallWindowProcW 4147->4148 4159 404c6c 4147->4159 4150 4052b6 4148->4150 4149->4150 4153->4148 4155 404c4b SendMessageW 4154->4155 4156 404c0f GetMessagePos ScreenToClient SendMessageW 4154->4156 4157 404c43 4155->4157 4156->4157 4158 404c48 4156->4158 4157->4147 4158->4155 4168 4062ba lstrcpynW 4159->4168 4161 404c7f 4169 406201 wsprintfW 4161->4169 4163 404c89 4164 40140b 2 API calls 4163->4164 4165 404c92 4164->4165 4170 4062ba lstrcpynW 4165->4170 4167 404c99 4167->4153 4168->4161 4169->4163 4170->4167 4171 402598 4172 4025c7 4171->4172 4173 4025ac 4171->4173 4175 4025fb 4172->4175 4176 4025cc 4172->4176 4174 402c1f 17 API calls 4173->4174 4181 4025b3 4174->4181 4178 402c41 17 API calls 4175->4178 4177 402c41 17 API calls 4176->4177 4179 4025d3 WideCharToMultiByte lstrlenA 4177->4179 4180 402602 lstrlenW 4178->4180 4179->4181 4180->4181 4182 40262f 4181->4182 4183 402645 4181->4183 4185 405e91 5 API calls 4181->4185 4182->4183 4184 405e62 WriteFile 4182->4184 4184->4183 4185->4182 4186 404c9e GetDlgItem GetDlgItem 4187 404cf0 7 API calls 4186->4187 4194 404f09 4186->4194 4188 404d93 DeleteObject 4187->4188 4189 404d86 SendMessageW 4187->4189 4190 404d9c 4188->4190 4189->4188 4192 404dd3 4190->4192 4193 4062dc 17 API calls 4190->4193 4191 404fed 4196 405099 4191->4196 4207 405046 SendMessageW 4191->4207 4229 404efc 4191->4229 4195 404231 18 API calls 4192->4195 4198 404db5 SendMessageW SendMessageW 4193->4198 4194->4191 4197 404f7a 4194->4197 4205 404bec 5 API calls 4194->4205 4201 404de7 4195->4201 4199 4050a3 SendMessageW 4196->4199 4200 4050ab 4196->4200 4197->4191 4203 404fdf SendMessageW 4197->4203 4198->4190 4199->4200 4204 4050d4 4200->4204 4209 4050c4 4200->4209 4210 4050bd ImageList_Destroy 4200->4210 4206 404231 18 API calls 4201->4206 4202 404298 8 API calls 4208 40528f 4202->4208 4203->4191 4212 405243 4204->4212 4228 404c6c 4 API calls 4204->4228 4233 40510f 4204->4233 4205->4197 4211 404df5 4206->4211 4213 40505b SendMessageW 4207->4213 4207->4229 4209->4204 4214 4050cd GlobalFree 4209->4214 4210->4209 4215 404eca GetWindowLongW SetWindowLongW 4211->4215 4222 404ec4 4211->4222 4225 404e45 SendMessageW 4211->4225 4226 404e81 SendMessageW 4211->4226 4227 404e92 SendMessageW 4211->4227 4216 405255 ShowWindow GetDlgItem ShowWindow 4212->4216 4212->4229 4218 40506e 4213->4218 4214->4204 4217 404ee3 4215->4217 4216->4229 4219 404f01 4217->4219 4220 404ee9 ShowWindow 4217->4220 4221 40507f SendMessageW 4218->4221 4238 404266 SendMessageW 4219->4238 4237 404266 SendMessageW 4220->4237 4221->4196 4222->4215 4222->4217 4225->4211 4226->4211 4227->4211 4228->4233 4229->4202 4230 405219 InvalidateRect 4230->4212 4231 40522f 4230->4231 4239 404ba7 4231->4239 4232 40513d SendMessageW 4236 405153 4232->4236 4233->4232 4233->4236 4235 4051c7 SendMessageW SendMessageW 4235->4236 4236->4230 4236->4235 4237->4229 4238->4194 4242 404ade 4239->4242 4241 404bbc 4241->4212 4243 404af7 4242->4243 4244 4062dc 17 API calls 4243->4244 4245 404b5b 4244->4245 4246 4062dc 17 API calls 4245->4246 4247 404b66 4246->4247 4248 4062dc 17 API calls 4247->4248 4249 404b7c lstrlenW wsprintfW SetDlgItemTextW 4248->4249 4249->4241 4250 40149e 4251 4022f7 4250->4251 4252 4014ac PostQuitMessage 4250->4252 4252->4251 3734 401c1f 3735 402c1f 17 API calls 3734->3735 3736 401c26 3735->3736 3737 402c1f 17 API calls 3736->3737 3738 401c33 3737->3738 3739 401c48 3738->3739 3741 402c41 17 API calls 3738->3741 3740 401c58 3739->3740 3742 402c41 17 API calls 3739->3742 3743 401c63 3740->3743 3744 401caf 3740->3744 3741->3739 3742->3740 3745 402c1f 17 API calls 3743->3745 3746 402c41 17 API calls 3744->3746 3747 401c68 3745->3747 3748 401cb4 3746->3748 3749 402c1f 17 API calls 3747->3749 3750 402c41 17 API calls 3748->3750 3751 401c74 3749->3751 3752 401cbd FindWindowExW 3750->3752 3753 401c81 SendMessageTimeoutW 3751->3753 3754 401c9f SendMessageW 3751->3754 3755 401cdf 3752->3755 3753->3755 3754->3755 4253 402aa0 SendMessageW 4254 402ac5 4253->4254 4255 402aba InvalidateRect 4253->4255 4255->4254 4256 402821 4257 402827 4256->4257 4258 402ac5 4257->4258 4259 40282f FindClose 4257->4259 4259->4258 4260 4043a1 lstrlenW 4261 4043c0 4260->4261 4262 4043c2 WideCharToMultiByte 4260->4262 4261->4262 4263 404722 4264 40474e 4263->4264 4265 40475f 4263->4265 4324 405904 GetDlgItemTextW 4264->4324 4267 40476b GetDlgItem 4265->4267 4273 4047ca 4265->4273 4269 40477f 4267->4269 4268 404759 4271 40654e 5 API calls 4268->4271 4272 404793 SetWindowTextW 4269->4272 4280 405c3a 4 API calls 4269->4280 4270 4048ae 4274 404a5d 4270->4274 4326 405904 GetDlgItemTextW 4270->4326 4271->4265 4276 404231 18 API calls 4272->4276 4273->4270 4273->4274 4277 4062dc 17 API calls 4273->4277 4279 404298 8 API calls 4274->4279 4281 4047af 4276->4281 4282 40483e SHBrowseForFolderW 4277->4282 4278 4048de 4283 405c97 18 API calls 4278->4283 4284 404a71 4279->4284 4285 404789 4280->4285 4286 404231 18 API calls 4281->4286 4282->4270 4287 404856 CoTaskMemFree 4282->4287 4288 4048e4 4283->4288 4285->4272 4291 405b8f 3 API calls 4285->4291 4289 4047bd 4286->4289 4290 405b8f 3 API calls 4287->4290 4327 4062ba lstrcpynW 4288->4327 4325 404266 SendMessageW 4289->4325 4293 404863 4290->4293 4291->4272 4296 40489a SetDlgItemTextW 4293->4296 4300 4062dc 17 API calls 4293->4300 4295 4047c3 4298 406694 5 API calls 4295->4298 4296->4270 4297 4048fb 4299 406694 5 API calls 4297->4299 4298->4273 4307 404902 4299->4307 4301 404882 lstrcmpiW 4300->4301 4301->4296 4304 404893 lstrcatW 4301->4304 4302 404943 4328 4062ba lstrcpynW 4302->4328 4304->4296 4305 40494a 4306 405c3a 4 API calls 4305->4306 4308 404950 GetDiskFreeSpaceW 4306->4308 4307->4302 4310 405bdb 2 API calls 4307->4310 4312 40499b 4307->4312 4311 404974 MulDiv 4308->4311 4308->4312 4310->4307 4311->4312 4313 404a0c 4312->4313 4314 404ba7 20 API calls 4312->4314 4315 404a2f 4313->4315 4317 40140b 2 API calls 4313->4317 4316 4049f9 4314->4316 4329 404253 KiUserCallbackDispatcher 4315->4329 4319 404a0e SetDlgItemTextW 4316->4319 4320 4049fe 4316->4320 4317->4315 4319->4313 4322 404ade 20 API calls 4320->4322 4321 404a4b 4321->4274 4323 40467b SendMessageW 4321->4323 4322->4313 4323->4274 4324->4268 4325->4295 4326->4278 4327->4297 4328->4305 4329->4321 4330 4015a3 4331 402c41 17 API calls 4330->4331 4332 4015aa SetFileAttributesW 4331->4332 4333 4015bc 4332->4333 4334 4029a8 4335 402c1f 17 API calls 4334->4335 4336 4029ae 4335->4336 4337 4029d5 4336->4337 4338 4029ee 4336->4338 4346 40288b 4336->4346 4341 4029da 4337->4341 4347 4029eb 4337->4347 4339 402a08 4338->4339 4340 4029f8 4338->4340 4343 4062dc 17 API calls 4339->4343 4342 402c1f 17 API calls 4340->4342 4348 4062ba lstrcpynW 4341->4348 4342->4347 4343->4347 4347->4346 4349 406201 wsprintfW 4347->4349 4348->4346 4349->4346 4350 4028ad 4351 402c41 17 API calls 4350->4351 4353 4028bb 4351->4353 4352 4028d1 4355 405d8b 2 API calls 4352->4355 4353->4352 4354 402c41 17 API calls 4353->4354 4354->4352 4356 4028d7 4355->4356 4378 405db0 GetFileAttributesW CreateFileW 4356->4378 4358 4028e4 4359 4028f0 GlobalAlloc 4358->4359 4360 402987 4358->4360 4363 402909 4359->4363 4364 40297e CloseHandle 4359->4364 4361 4029a2 4360->4361 4362 40298f DeleteFileW 4360->4362 4362->4361 4379 403347 SetFilePointer 4363->4379 4364->4360 4366 40290f 4367 403331 ReadFile 4366->4367 4368 402918 GlobalAlloc 4367->4368 4369 402928 4368->4369 4370 40295c 4368->4370 4371 403116 31 API calls 4369->4371 4372 405e62 WriteFile 4370->4372 4374 402935 4371->4374 4373 402968 GlobalFree 4372->4373 4375 403116 31 API calls 4373->4375 4376 402953 GlobalFree 4374->4376 4377 40297b 4375->4377 4376->4370 4377->4364 4378->4358 4379->4366 4380 401a30 4381 402c41 17 API calls 4380->4381 4382 401a39 ExpandEnvironmentStringsW 4381->4382 4383 401a4d 4382->4383 4385 401a60 4382->4385 4384 401a52 lstrcmpW 4383->4384 4383->4385 4384->4385 3593 402032 3594 402044 3593->3594 3604 4020f6 3593->3604 3595 402c41 17 API calls 3594->3595 3597 40204b 3595->3597 3596 401423 24 API calls 3598 402250 3596->3598 3599 402c41 17 API calls 3597->3599 3600 402054 3599->3600 3601 40206a LoadLibraryExW 3600->3601 3602 40205c GetModuleHandleW 3600->3602 3603 40207b 3601->3603 3601->3604 3602->3601 3602->3603 3613 406703 WideCharToMultiByte 3603->3613 3604->3596 3607 4020c5 3609 405322 24 API calls 3607->3609 3608 40208c 3610 401423 24 API calls 3608->3610 3611 40209c 3608->3611 3609->3611 3610->3611 3611->3598 3612 4020e8 FreeLibrary 3611->3612 3612->3598 3614 40672d GetProcAddress 3613->3614 3615 402086 3613->3615 3614->3615 3615->3607 3615->3608 4391 401735 4392 402c41 17 API calls 4391->4392 4393 40173c SearchPathW 4392->4393 4394 401757 4393->4394 4395 402a35 4396 402c1f 17 API calls 4395->4396 4397 402a3b 4396->4397 4398 402a72 4397->4398 4399 40288b 4397->4399 4401 402a4d 4397->4401 4398->4399 4400 4062dc 17 API calls 4398->4400 4400->4399 4401->4399 4403 406201 wsprintfW 4401->4403 4403->4399 4404 4014b8 4405 4014be 4404->4405 4406 401389 2 API calls 4405->4406 4407 4014c6 4406->4407 4408 401db9 GetDC 4409 402c1f 17 API calls 4408->4409 4410 401dcb GetDeviceCaps MulDiv ReleaseDC 4409->4410 4411 402c1f 17 API calls 4410->4411 4412 401dfc 4411->4412 4413 4062dc 17 API calls 4412->4413 4414 401e39 CreateFontIndirectW 4413->4414 4415 402592 4414->4415 4416 40283b 4417 402843 4416->4417 4418 402847 FindNextFileW 4417->4418 4421 402859 4417->4421 4419 4028a0 4418->4419 4418->4421 4422 4062ba lstrcpynW 4419->4422 4422->4421

                                                                                                                                                                                                                    Executed Functions

                                                                                                                                                                                                                    Function 0040338F Relevance: 75.7, APIs: 33, Strings: 10, Instructions: 410stringfilecomCOMMON
                                                                                                                                                                                                                    Download Yara Rule

                                                                                                                                                                                                                    Control-flow Graph

                                                                                                                                                                                                                    • Executed
                                                                                                                                                                                                                    • Not Executed
                                                                                                                                                                                                                    control_flow_graph 0 40338f-4033cc SetErrorMode GetVersion 1 4033ce-4033d6 call 406694 0->1 2 4033df 0->2 1->2 7 4033d8 1->7 4 4033e4-4033f8 call 406624 lstrlenA 2->4 9 4033fa-403416 call 406694 * 3 4->9 7->2 16 403427-403486 #17 OleInitialize SHGetFileInfoW call 4062ba GetCommandLineW call 4062ba 9->16 17 403418-40341e 9->17 24 403490-4034aa call 405bbc CharNextW 16->24 25 403488-40348f 16->25 17->16 21 403420 17->21 21->16 28 4034b0-4034b6 24->28 29 4035c1-4035db GetTempPathW call 40335e 24->29 25->24 30 4034b8-4034bd 28->30 31 4034bf-4034c3 28->31 38 403633-40364d DeleteFileW call 402edd 29->38 39 4035dd-4035fb GetWindowsDirectoryW lstrcatW call 40335e 29->39 30->30 30->31 33 4034c5-4034c9 31->33 34 4034ca-4034ce 31->34 33->34 36 4034d4-4034da 34->36 37 40358d-40359a call 405bbc 34->37 43 4034f5-40352e 36->43 44 4034dc-4034e4 36->44 54 40359c-40359d 37->54 55 40359e-4035a4 37->55 56 403653-403659 38->56 57 4036fe-40370e ExitProcess CoUninitialize 38->57 39->38 52 4035fd-40362d GetTempPathW lstrcatW SetEnvironmentVariableW * 2 call 40335e 39->52 50 403530-403535 43->50 51 40354b-403585 43->51 48 4034e6-4034e9 44->48 49 4034eb 44->49 48->43 48->49 49->43 50->51 58 403537-40353f 50->58 51->37 53 403587-40358b 51->53 52->38 52->57 53->37 60 4035ac-4035ba call 4062ba 53->60 54->55 55->28 61 4035aa 55->61 62 4036ee-4036f5 call 4039aa 56->62 63 40365f-40366a call 405bbc 56->63 64 403834-40383a 57->64 65 403714-403724 call 405920 ExitProcess 57->65 66 403541-403544 58->66 67 403546 58->67 71 4035bf 60->71 61->71 80 4036fa 62->80 84 4036b8-4036c2 63->84 85 40366c-4036a1 63->85 68 4038b8-4038c0 64->68 69 40383c-403852 GetCurrentProcess OpenProcessToken 64->69 66->51 66->67 67->51 81 4038c2 68->81 82 4038c6-4038ca ExitProcess 68->82 77 403854-403882 LookupPrivilegeValueW AdjustTokenPrivileges 69->77 78 403888-403896 call 406694 69->78 71->29 77->78 92 4038a4-4038af ExitWindowsEx 78->92 93 403898-4038a2 78->93 80->57 81->82 86 4036c4-4036d2 call 405c97 84->86 87 40372a-40373e call 40588b lstrcatW 84->87 89 4036a3-4036a7 85->89 86->57 102 4036d4-4036ea call 4062ba * 2 86->102 100 403740-403746 lstrcatW 87->100 101 40374b-403765 lstrcatW lstrcmpiW 87->101 94 4036b0-4036b4 89->94 95 4036a9-4036ae 89->95 92->68 99 4038b1-4038b3 call 40140b 92->99 93->92 93->99 94->89 96 4036b6 94->96 95->94 95->96 96->84 99->68 100->101 101->57 105 403767-40376a 101->105 102->62 107 403773 call 40586e 105->107 108 40376c-403771 call 4057f1 105->108 115 403778-403786 SetCurrentDirectoryW 107->115 108->115 116 403793-4037bc call 4062ba 115->116 117 403788-40378e call 4062ba 115->117 121 4037c1-4037dd call 4062dc DeleteFileW 116->121 117->116 124 40381e-403826 121->124 125 4037df-4037ef CopyFileW 121->125 124->121 127 403828-40382f call 406080 124->127 125->124 126 4037f1-403811 call 406080 call 4062dc call 4058a3 125->126 126->124 136 403813-40381a CloseHandle 126->136 127->57 136->124
                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                    • SetErrorMode.KERNELBASE ref: 004033B2
                                                                                                                                                                                                                    • GetVersion.KERNEL32 ref: 004033B8
                                                                                                                                                                                                                    • lstrlenA.KERNEL32(UXTHEME,UXTHEME), ref: 004033EB
                                                                                                                                                                                                                    • #17.COMCTL32(?,00000006,00000008,0000000A), ref: 00403428
                                                                                                                                                                                                                    • OleInitialize.OLE32(00000000), ref: 0040342F
                                                                                                                                                                                                                    • SHGetFileInfoW.SHELL32(00440208,00000000,?,000002B4,00000000), ref: 0040344B
                                                                                                                                                                                                                    • GetCommandLineW.KERNEL32(00472EE0,NSIS Error,?,00000006,00000008,0000000A), ref: 00403460
                                                                                                                                                                                                                    • CharNextW.USER32(00000000,004CB000,00000020,004CB000,00000000,?,00000006,00000008,0000000A), ref: 00403498
                                                                                                                                                                                                                      • Part of subcall function 00406694: GetModuleHandleA.KERNEL32(?,00000020,?,00403401,0000000A), ref: 004066A6
                                                                                                                                                                                                                      • Part of subcall function 00406694: GetProcAddress.KERNEL32(00000000,?), ref: 004066C1
                                                                                                                                                                                                                    • GetTempPathW.KERNEL32(00002000,004DF000,?,00000006,00000008,0000000A), ref: 004035D2
                                                                                                                                                                                                                    • GetWindowsDirectoryW.KERNEL32(004DF000,00001FFB,?,00000006,00000008,0000000A), ref: 004035E3
                                                                                                                                                                                                                    • lstrcatW.KERNEL32(004DF000,\Temp,?,00000006,00000008,0000000A), ref: 004035EF
                                                                                                                                                                                                                    • GetTempPathW.KERNEL32(00001FFC,004DF000,004DF000,\Temp,?,00000006,00000008,0000000A), ref: 00403603
                                                                                                                                                                                                                    • lstrcatW.KERNEL32(004DF000,Low,?,00000006,00000008,0000000A), ref: 0040360B
                                                                                                                                                                                                                    • SetEnvironmentVariableW.KERNEL32(TEMP,004DF000,004DF000,Low,?,00000006,00000008,0000000A), ref: 0040361C
                                                                                                                                                                                                                    • SetEnvironmentVariableW.KERNEL32(TMP,004DF000,?,00000006,00000008,0000000A), ref: 00403624
                                                                                                                                                                                                                    • DeleteFileW.KERNELBASE(004DB000,?,00000006,00000008,0000000A), ref: 00403638
                                                                                                                                                                                                                      • Part of subcall function 004062BA: lstrcpynW.KERNEL32(?,?,00002000,00403460,00472EE0,NSIS Error,?,00000006,00000008,0000000A), ref: 004062C7
                                                                                                                                                                                                                    • ExitProcess.KERNEL32(00000006,?,00000006,00000008,0000000A), ref: 004036FE
                                                                                                                                                                                                                    • CoUninitialize.COMBASE(00000006,?,00000006,00000008,0000000A), ref: 00403703
                                                                                                                                                                                                                    • ExitProcess.KERNEL32 ref: 00403724
                                                                                                                                                                                                                    • lstrcatW.KERNEL32(004DF000,~nsu,004CB000,00000000,00000006,?,00000006,00000008,0000000A), ref: 00403737
                                                                                                                                                                                                                    • lstrcatW.KERNEL32(004DF000,0040A26C,004DF000,~nsu,004CB000,00000000,00000006,?,00000006,00000008,0000000A), ref: 00403746
                                                                                                                                                                                                                    • lstrcatW.KERNEL32(004DF000,.tmp,004DF000,~nsu,004CB000,00000000,00000006,?,00000006,00000008,0000000A), ref: 00403751
                                                                                                                                                                                                                    • lstrcmpiW.KERNEL32(004DF000,004D7000,004DF000,.tmp,004DF000,~nsu,004CB000,00000000,00000006,?,00000006,00000008,0000000A), ref: 0040375D
                                                                                                                                                                                                                    • SetCurrentDirectoryW.KERNEL32(004DF000,004DF000,?,00000006,00000008,0000000A), ref: 00403779
                                                                                                                                                                                                                    • DeleteFileW.KERNEL32(0043C208,0043C208,?,0047B000,00000008,?,00000006,00000008,0000000A), ref: 004037D3
                                                                                                                                                                                                                    • CopyFileW.KERNEL32(004E7000,0043C208,00000001,?,00000006,00000008,0000000A), ref: 004037E7
                                                                                                                                                                                                                    • CloseHandle.KERNEL32(00000000,0043C208,0043C208,?,0043C208,00000000,?,00000006,00000008,0000000A), ref: 00403814
                                                                                                                                                                                                                    • GetCurrentProcess.KERNEL32(00000028,0000000A,00000006,00000008,0000000A), ref: 00403843
                                                                                                                                                                                                                    • OpenProcessToken.ADVAPI32(00000000), ref: 0040384A
                                                                                                                                                                                                                    • LookupPrivilegeValueW.ADVAPI32(00000000,SeShutdownPrivilege,?), ref: 0040385F
                                                                                                                                                                                                                    • AdjustTokenPrivileges.ADVAPI32 ref: 00403882
                                                                                                                                                                                                                    • ExitWindowsEx.USER32(00000002,80040002), ref: 004038A7
                                                                                                                                                                                                                    • ExitProcess.KERNEL32 ref: 004038CA
                                                                                                                                                                                                                    Strings
                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                    • Source File: 00000000.00000002.2527338492.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527299574.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527452560.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.0000000000460000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.0000000000464000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2528550754.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                    • Snapshot File: hcaresult_0_2_400000_cMqyGFCQHk.jbxd
                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                    • API ID: Processlstrcat$ExitFile$CurrentDeleteDirectoryEnvironmentHandlePathTempTokenVariableWindows$AddressAdjustCharCloseCommandCopyErrorInfoInitializeLineLookupModeModuleNextOpenPrivilegePrivilegesProcUninitializeValueVersionlstrcmpilstrcpynlstrlen
                                                                                                                                                                                                                    • String ID: .tmp$Error launching installer$Low$NSIS Error$SeShutdownPrivilege$TEMP$TMP$UXTHEME$\Temp$~nsu
                                                                                                                                                                                                                    • API String ID: 424501083-3195845224
                                                                                                                                                                                                                    • Opcode ID: d8143391da9922f0f8fdd9eae6183e51d391a53b8ae8d145ad5f2599bc791527
                                                                                                                                                                                                                    • Instruction ID: 33fbdd78d52bfd04f2c73b4da217482bb076a8c6d1615cdfa2cd3638f3c4bec2
                                                                                                                                                                                                                    • Opcode Fuzzy Hash: d8143391da9922f0f8fdd9eae6183e51d391a53b8ae8d145ad5f2599bc791527
                                                                                                                                                                                                                    • Instruction Fuzzy Hash: 45D1F471100310AAE720BF769D45B2B3AADEB4070AF10447FF885B62E1DBBD8D55876E
                                                                                                                                                                                                                    Function 00405461 Relevance: 66.8, APIs: 36, Strings: 2, Instructions: 284windowclipboardmemoryCOMMON
                                                                                                                                                                                                                    Download Yara Rule

                                                                                                                                                                                                                    Control-flow Graph

                                                                                                                                                                                                                    • Executed
                                                                                                                                                                                                                    • Not Executed
                                                                                                                                                                                                                    control_flow_graph 137 405461-40547c 138 405482-405549 GetDlgItem * 3 call 404266 call 404bbf GetClientRect GetSystemMetrics SendMessageW * 2 137->138 139 40560b-405612 137->139 160 405567-40556a 138->160 161 40554b-405565 SendMessageW * 2 138->161 141 405614-405636 GetDlgItem CreateThread CloseHandle 139->141 142 40563c-405649 139->142 141->142 144 405667-405671 142->144 145 40564b-405651 142->145 149 405673-405679 144->149 150 4056c7-4056cb 144->150 147 405653-405662 ShowWindow * 2 call 404266 145->147 148 40568c-405695 call 404298 145->148 147->144 157 40569a-40569e 148->157 155 4056a1-4056b1 ShowWindow 149->155 156 40567b-405687 call 40420a 149->156 150->148 153 4056cd-4056d3 150->153 153->148 162 4056d5-4056e8 SendMessageW 153->162 158 4056c1-4056c2 call 40420a 155->158 159 4056b3-4056bc call 405322 155->159 156->148 158->150 159->158 166 40557a-405591 call 404231 160->166 167 40556c-405578 SendMessageW 160->167 161->160 168 4057ea-4057ec 162->168 169 4056ee-405719 CreatePopupMenu call 4062dc AppendMenuW 162->169 176 405593-4055a7 ShowWindow 166->176 177 4055c7-4055e8 GetDlgItem SendMessageW 166->177 167->166 168->157 174 40571b-40572b GetWindowRect 169->174 175 40572e-405743 TrackPopupMenu 169->175 174->175 175->168 179 405749-405760 175->179 180 4055b6 176->180 181 4055a9-4055b4 ShowWindow 176->181 177->168 178 4055ee-405606 SendMessageW * 2 177->178 178->168 182 405765-405780 SendMessageW 179->182 183 4055bc-4055c2 call 404266 180->183 181->183 182->182 184 405782-4057a5 OpenClipboard EmptyClipboard GlobalAlloc GlobalLock 182->184 183->177 186 4057a7-4057ce SendMessageW 184->186 186->186 187 4057d0-4057e4 GlobalUnlock SetClipboardData CloseClipboard 186->187 187->168
                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                    • GetDlgItem.USER32(?,00000403), ref: 004054BF
                                                                                                                                                                                                                    • GetDlgItem.USER32(?,000003EE), ref: 004054CE
                                                                                                                                                                                                                    • GetClientRect.USER32(?,?), ref: 0040550B
                                                                                                                                                                                                                    • GetSystemMetrics.USER32(00000002), ref: 00405512
                                                                                                                                                                                                                    • SendMessageW.USER32(?,00001061,00000000,?), ref: 00405533
                                                                                                                                                                                                                    • SendMessageW.USER32(?,00001036,00004000,00004000), ref: 00405544
                                                                                                                                                                                                                    • SendMessageW.USER32(?,00001001,00000000,00000110), ref: 00405557
                                                                                                                                                                                                                    • SendMessageW.USER32(?,00001026,00000000,00000110), ref: 00405565
                                                                                                                                                                                                                    • SendMessageW.USER32(?,00001024,00000000,?), ref: 00405578
                                                                                                                                                                                                                    • ShowWindow.USER32(00000000,?,0000001B,000000FF), ref: 0040559A
                                                                                                                                                                                                                    • ShowWindow.USER32(?,00000008), ref: 004055AE
                                                                                                                                                                                                                    • GetDlgItem.USER32(?,000003EC), ref: 004055CF
                                                                                                                                                                                                                    • SendMessageW.USER32(00000000,00000401,00000000,75300000), ref: 004055DF
                                                                                                                                                                                                                    • SendMessageW.USER32(00000000,00000409,00000000,?), ref: 004055F8
                                                                                                                                                                                                                    • SendMessageW.USER32(00000000,00002001,00000000,00000110), ref: 00405604
                                                                                                                                                                                                                    • GetDlgItem.USER32(?,000003F8), ref: 004054DD
                                                                                                                                                                                                                      • Part of subcall function 00404266: SendMessageW.USER32(00000028,?,00000001,00404091), ref: 00404274
                                                                                                                                                                                                                    • GetDlgItem.USER32(?,000003EC), ref: 00405621
                                                                                                                                                                                                                    • CreateThread.KERNELBASE(00000000,00000000,Function_000053F5,00000000), ref: 0040562F
                                                                                                                                                                                                                    • CloseHandle.KERNELBASE(00000000), ref: 00405636
                                                                                                                                                                                                                    • ShowWindow.USER32(00000000), ref: 0040565A
                                                                                                                                                                                                                    • ShowWindow.USER32(?,00000008), ref: 0040565F
                                                                                                                                                                                                                    • ShowWindow.USER32(00000008), ref: 004056A9
                                                                                                                                                                                                                    • SendMessageW.USER32(?,00001004,00000000,00000000), ref: 004056DD
                                                                                                                                                                                                                    • CreatePopupMenu.USER32 ref: 004056EE
                                                                                                                                                                                                                    • AppendMenuW.USER32(00000000,00000000,00000001,00000000), ref: 00405702
                                                                                                                                                                                                                    • GetWindowRect.USER32(?,?), ref: 00405722
                                                                                                                                                                                                                    • TrackPopupMenu.USER32(00000000,00000180,?,?,00000000,?,00000000), ref: 0040573B
                                                                                                                                                                                                                    • SendMessageW.USER32(?,00001073,00000000,?), ref: 00405773
                                                                                                                                                                                                                    • OpenClipboard.USER32(00000000), ref: 00405783
                                                                                                                                                                                                                    • EmptyClipboard.USER32 ref: 00405789
                                                                                                                                                                                                                    • GlobalAlloc.KERNEL32(00000042,00000000), ref: 00405795
                                                                                                                                                                                                                    • GlobalLock.KERNEL32(00000000), ref: 0040579F
                                                                                                                                                                                                                    • SendMessageW.USER32(?,00001073,00000000,?), ref: 004057B3
                                                                                                                                                                                                                    • GlobalUnlock.KERNEL32(00000000), ref: 004057D3
                                                                                                                                                                                                                    • SetClipboardData.USER32(0000000D,00000000), ref: 004057DE
                                                                                                                                                                                                                    • CloseClipboard.USER32 ref: 004057E4
                                                                                                                                                                                                                    Strings
                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                    • Source File: 00000000.00000002.2527338492.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527299574.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527452560.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.0000000000460000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.0000000000464000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2528550754.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                    • Snapshot File: hcaresult_0_2_400000_cMqyGFCQHk.jbxd
                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                    • API ID: MessageSend$Window$ItemShow$Clipboard$GlobalMenu$CloseCreatePopupRect$AllocAppendClientDataEmptyHandleLockMetricsOpenSystemThreadTrackUnlock
                                                                                                                                                                                                                    • String ID: {$|k
                                                                                                                                                                                                                    • API String ID: 590372296-403280167
                                                                                                                                                                                                                    • Opcode ID: 3f5756e17ddf514bb7e58e27119461a6e63aa272c655e6837988b65713ff16ec
                                                                                                                                                                                                                    • Instruction ID: bae72a1d173c3811f2fd5642bc5838002141c6bee16c4b6d0499208050eeb164
                                                                                                                                                                                                                    • Opcode Fuzzy Hash: 3f5756e17ddf514bb7e58e27119461a6e63aa272c655e6837988b65713ff16ec
                                                                                                                                                                                                                    • Instruction Fuzzy Hash: 3CB12970900608FFDB119FA0DE89EAE7B79FB48354F00413AFA45A61A0CBB55E91DF58
                                                                                                                                                                                                                    Function 004059CC Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 148filestringCOMMON
                                                                                                                                                                                                                    Download Yara Rule

                                                                                                                                                                                                                    Control-flow Graph

                                                                                                                                                                                                                    • Executed
                                                                                                                                                                                                                    • Not Executed
                                                                                                                                                                                                                    control_flow_graph 497 4059cc-4059f2 call 405c97 500 4059f4-405a06 DeleteFileW 497->500 501 405a0b-405a12 497->501 502 405b88-405b8c 500->502 503 405a14-405a16 501->503 504 405a25-405a35 call 4062ba 501->504 505 405b36-405b3b 503->505 506 405a1c-405a1f 503->506 510 405a44-405a45 call 405bdb 504->510 511 405a37-405a42 lstrcatW 504->511 505->502 509 405b3d-405b40 505->509 506->504 506->505 512 405b42-405b48 509->512 513 405b4a-405b52 call 4065fd 509->513 514 405a4a-405a4e 510->514 511->514 512->502 513->502 521 405b54-405b68 call 405b8f call 405984 513->521 517 405a50-405a58 514->517 518 405a5a-405a60 lstrcatW 514->518 517->518 520 405a65-405a81 lstrlenW FindFirstFileW 517->520 518->520 522 405a87-405a8f 520->522 523 405b2b-405b2f 520->523 537 405b80-405b83 call 405322 521->537 538 405b6a-405b6d 521->538 527 405a91-405a99 522->527 528 405aaf-405ac3 call 4062ba 522->528 523->505 526 405b31 523->526 526->505 531 405a9b-405aa3 527->531 532 405b0e-405b1e FindNextFileW 527->532 539 405ac5-405acd 528->539 540 405ada-405ae5 call 405984 528->540 531->528 533 405aa5-405aad 531->533 532->522 536 405b24-405b25 FindClose 532->536 533->528 533->532 536->523 537->502 538->512 541 405b6f-405b7e call 405322 call 406080 538->541 539->532 542 405acf-405ad3 call 4059cc 539->542 550 405b06-405b09 call 405322 540->550 551 405ae7-405aea 540->551 541->502 549 405ad8 542->549 549->532 550->532 554 405aec-405afc call 405322 call 406080 551->554 555 405afe-405b04 551->555 554->532 555->532
                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                    • DeleteFileW.KERNELBASE(?,?,004DF000,76233420,00000000), ref: 004059F5
                                                                                                                                                                                                                    • lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\nshFAEA.tmp\7z-out\resources\app.asar.unpacked\node_modules\ps-list\vendor\*.*,\*.*,C:\Users\user\AppData\Local\Temp\nshFAEA.tmp\7z-out\resources\app.asar.unpacked\node_modules\ps-list\vendor\*.*,?,?,004DF000,76233420,00000000), ref: 00405A3D
                                                                                                                                                                                                                    • lstrcatW.KERNEL32(?,0040A014,?,C:\Users\user\AppData\Local\Temp\nshFAEA.tmp\7z-out\resources\app.asar.unpacked\node_modules\ps-list\vendor\*.*,?,?,004DF000,76233420,00000000), ref: 00405A60
                                                                                                                                                                                                                    • lstrlenW.KERNEL32(?,?,0040A014,?,C:\Users\user\AppData\Local\Temp\nshFAEA.tmp\7z-out\resources\app.asar.unpacked\node_modules\ps-list\vendor\*.*,?,?,004DF000,76233420,00000000), ref: 00405A66
                                                                                                                                                                                                                    • FindFirstFileW.KERNELBASE(C:\Users\user\AppData\Local\Temp\nshFAEA.tmp\7z-out\resources\app.asar.unpacked\node_modules\ps-list\vendor\*.*,?,?,?,0040A014,?,C:\Users\user\AppData\Local\Temp\nshFAEA.tmp\7z-out\resources\app.asar.unpacked\node_modules\ps-list\vendor\*.*,?,?,004DF000,76233420,00000000), ref: 00405A76
                                                                                                                                                                                                                    • FindNextFileW.KERNELBASE(00000000,00000010,000000F2,?,?,?,?,0000002E), ref: 00405B16
                                                                                                                                                                                                                    • FindClose.KERNEL32(00000000), ref: 00405B25
                                                                                                                                                                                                                    Strings
                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                    • Source File: 00000000.00000002.2527338492.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527299574.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527452560.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.0000000000460000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.0000000000464000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2528550754.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                    • Snapshot File: hcaresult_0_2_400000_cMqyGFCQHk.jbxd
                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                    • API ID: FileFind$lstrcat$CloseDeleteFirstNextlstrlen
                                                                                                                                                                                                                    • String ID: C:\Users\user\AppData\Local\Temp\nshFAEA.tmp\7z-out\resources\app.asar.unpacked\node_modules\ps-list\vendor\*.*$\*.*
                                                                                                                                                                                                                    • API String ID: 2035342205-453812570
                                                                                                                                                                                                                    • Opcode ID: 381ae1539308b0fff5c23660480c7799636f68814d34eb948432fba1f876741c
                                                                                                                                                                                                                    • Instruction ID: 3baa02bdf70247edfb0f680676f8bffda79515ede8bd61e7e13478a9eee65f3b
                                                                                                                                                                                                                    • Opcode Fuzzy Hash: 381ae1539308b0fff5c23660480c7799636f68814d34eb948432fba1f876741c
                                                                                                                                                                                                                    • Instruction Fuzzy Hash: E141D430900914AACB21AB618C89ABF7778EF45369F10427FF801711D1D77CAD81DE6E
                                                                                                                                                                                                                    Function 004065FD Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 14fileCOMMON
                                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                    • FindFirstFileW.KERNELBASE(004DF000,00468298,C:\,00405CE0,C:\,C:\,00000000,C:\,C:\,004DF000,?,76233420,004059EC,?,004DF000,76233420), ref: 00406608
                                                                                                                                                                                                                    • FindClose.KERNELBASE(00000000), ref: 00406614
                                                                                                                                                                                                                    Strings
                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                    • Source File: 00000000.00000002.2527338492.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527299574.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527452560.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.0000000000460000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.0000000000464000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2528550754.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                    • Snapshot File: hcaresult_0_2_400000_cMqyGFCQHk.jbxd
                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                    • API ID: Find$CloseFileFirst
                                                                                                                                                                                                                    • String ID: C:\
                                                                                                                                                                                                                    • API String ID: 2295610775-3404278061
                                                                                                                                                                                                                    • Opcode ID: f7cd178be2e6469beafc72b660366141f3ce998a63a06fca00c04ee689428cf9
                                                                                                                                                                                                                    • Instruction ID: 086872f0bf6ffc0fec3bf9e050170664210a11ef237051a194e92f35cf11c1a2
                                                                                                                                                                                                                    • Opcode Fuzzy Hash: f7cd178be2e6469beafc72b660366141f3ce998a63a06fca00c04ee689428cf9
                                                                                                                                                                                                                    • Instruction Fuzzy Hash: 52D012315455205BC7001B386E0C85B7B599F553317158F37F46AF51E0DB758C62869D
                                                                                                                                                                                                                    Function 00403D58 Relevance: 58.1, APIs: 32, Strings: 1, Instructions: 346windowstringCOMMON
                                                                                                                                                                                                                    Download Yara Rule

                                                                                                                                                                                                                    Control-flow Graph

                                                                                                                                                                                                                    • Executed
                                                                                                                                                                                                                    • Not Executed
                                                                                                                                                                                                                    control_flow_graph 188 403d58-403d6a 189 403d70-403d76 188->189 190 403eab-403eba 188->190 189->190 191 403d7c-403d85 189->191 192 403f09-403f1e 190->192 193 403ebc-403f04 GetDlgItem * 2 call 404231 SetClassLongW call 40140b 190->193 196 403d87-403d94 SetWindowPos 191->196 197 403d9a-403d9d 191->197 194 403f20-403f23 192->194 195 403f5e-403f63 call 40427d 192->195 193->192 199 403f25-403f30 call 401389 194->199 200 403f56-403f58 194->200 207 403f68-403f83 195->207 196->197 202 403db7-403dbd 197->202 203 403d9f-403db1 ShowWindow 197->203 199->200 221 403f32-403f51 SendMessageW 199->221 200->195 206 4041fe 200->206 208 403dd9-403ddc 202->208 209 403dbf-403dd4 DestroyWindow 202->209 203->202 214 404200-404207 206->214 212 403f85-403f87 call 40140b 207->212 213 403f8c-403f92 207->213 217 403dde-403dea SetWindowLongW 208->217 218 403def-403df5 208->218 215 4041db-4041e1 209->215 212->213 224 403f98-403fa3 213->224 225 4041bc-4041d5 DestroyWindow EndDialog 213->225 215->206 223 4041e3-4041e9 215->223 217->214 219 403e98-403ea6 call 404298 218->219 220 403dfb-403e0c GetDlgItem 218->220 219->214 226 403e2b-403e2e 220->226 227 403e0e-403e25 SendMessageW IsWindowEnabled 220->227 221->214 223->206 229 4041eb-4041f4 ShowWindow 223->229 224->225 230 403fa9-403ff6 call 4062dc call 404231 * 3 GetDlgItem 224->230 225->215 231 403e30-403e31 226->231 232 403e33-403e36 226->232 227->206 227->226 229->206 258 404000-40403c ShowWindow KiUserCallbackDispatcher call 404253 EnableWindow 230->258 259 403ff8-403ffd 230->259 235 403e61-403e66 call 40420a 231->235 236 403e44-403e49 232->236 237 403e38-403e3e 232->237 235->219 241 403e7f-403e92 SendMessageW 236->241 242 403e4b-403e51 236->242 240 403e40-403e42 237->240 237->241 240->235 241->219 246 403e53-403e59 call 40140b 242->246 247 403e68-403e71 call 40140b 242->247 256 403e5f 246->256 247->219 255 403e73-403e7d 247->255 255->256 256->235 262 404041 258->262 263 40403e-40403f 258->263 259->258 264 404043-404071 GetSystemMenu EnableMenuItem SendMessageW 262->264 263->264 265 404073-404084 SendMessageW 264->265 266 404086 264->266 267 40408c-4040cb call 404266 call 403d39 call 4062ba lstrlenW call 4062dc SetWindowTextW call 401389 265->267 266->267 267->207 278 4040d1-4040d3 267->278 278->207 279 4040d9-4040dd 278->279 280 4040fc-404110 DestroyWindow 279->280 281 4040df-4040e5 279->281 280->215 282 404116-404143 CreateDialogParamW 280->282 281->206 283 4040eb-4040f1 281->283 282->215 284 404149-4041a0 call 404231 GetDlgItem GetWindowRect ScreenToClient SetWindowPos call 401389 282->284 283->207 285 4040f7 283->285 284->206 290 4041a2-4041b5 ShowWindow call 40427d 284->290 285->206 292 4041ba 290->292 292->215
                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                    • SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000013), ref: 00403D94
                                                                                                                                                                                                                    • ShowWindow.USER32(?), ref: 00403DB1
                                                                                                                                                                                                                    • DestroyWindow.USER32 ref: 00403DC5
                                                                                                                                                                                                                    • SetWindowLongW.USER32(?,00000000,00000000), ref: 00403DE1
                                                                                                                                                                                                                    • GetDlgItem.USER32(?,?), ref: 00403E02
                                                                                                                                                                                                                    • SendMessageW.USER32(00000000,000000F3,00000000,00000000), ref: 00403E16
                                                                                                                                                                                                                    • IsWindowEnabled.USER32(00000000), ref: 00403E1D
                                                                                                                                                                                                                    • GetDlgItem.USER32(?,00000001), ref: 00403ECB
                                                                                                                                                                                                                    • GetDlgItem.USER32(?,00000002), ref: 00403ED5
                                                                                                                                                                                                                    • SetClassLongW.USER32(?,000000F2,?), ref: 00403EEF
                                                                                                                                                                                                                    • SendMessageW.USER32(0000040F,00000000,00000001,?), ref: 00403F40
                                                                                                                                                                                                                    • GetDlgItem.USER32(?,00000003), ref: 00403FE6
                                                                                                                                                                                                                    • ShowWindow.USER32(00000000,?), ref: 00404007
                                                                                                                                                                                                                    • KiUserCallbackDispatcher.NTDLL(?,?), ref: 00404019
                                                                                                                                                                                                                    • EnableWindow.USER32(?,?), ref: 00404034
                                                                                                                                                                                                                    • GetSystemMenu.USER32(?,00000000,0000F060,00000001), ref: 0040404A
                                                                                                                                                                                                                    • EnableMenuItem.USER32(00000000), ref: 00404051
                                                                                                                                                                                                                    • SendMessageW.USER32(?,000000F4,00000000,00000001), ref: 00404069
                                                                                                                                                                                                                    • SendMessageW.USER32(?,00000401,00000002,00000000), ref: 0040407C
                                                                                                                                                                                                                    • lstrlenW.KERNEL32(00450248,?,00450248,00000000), ref: 004040A6
                                                                                                                                                                                                                    • SetWindowTextW.USER32(?,00450248), ref: 004040BA
                                                                                                                                                                                                                    • ShowWindow.USER32(?,0000000A), ref: 004041EE
                                                                                                                                                                                                                    Strings
                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                    • Source File: 00000000.00000002.2527338492.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527299574.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527452560.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.0000000000460000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.0000000000464000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2528550754.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                    • Snapshot File: hcaresult_0_2_400000_cMqyGFCQHk.jbxd
                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                    • API ID: Window$Item$MessageSend$Show$EnableLongMenu$CallbackClassDestroyDispatcherEnabledSystemTextUserlstrlen
                                                                                                                                                                                                                    • String ID: |k
                                                                                                                                                                                                                    • API String ID: 3282139019-823491253
                                                                                                                                                                                                                    • Opcode ID: fc0f4d7be1e4c82c86fade982caad82dc734dafc7249948e3003efd3e17736fb
                                                                                                                                                                                                                    • Instruction ID: ebd8885eb79f40fe398f9982bcc50e4b60f6275a3dc5f5776bcae5bce4ead0d0
                                                                                                                                                                                                                    • Opcode Fuzzy Hash: fc0f4d7be1e4c82c86fade982caad82dc734dafc7249948e3003efd3e17736fb
                                                                                                                                                                                                                    • Instruction Fuzzy Hash: AFC1D5B1500304ABDB206F61EE88E2B3A78FB95346F00053EF645B51F1CB799891DB6E
                                                                                                                                                                                                                    Function 004039AA Relevance: 38.7, APIs: 13, Strings: 9, Instructions: 215stringregistryCOMMON
                                                                                                                                                                                                                    Download Yara Rule

                                                                                                                                                                                                                    Control-flow Graph

                                                                                                                                                                                                                    • Executed
                                                                                                                                                                                                                    • Not Executed
                                                                                                                                                                                                                    control_flow_graph 293 4039aa-4039c2 call 406694 296 4039c4-4039d4 call 406201 293->296 297 4039d6-403a0d call 406188 293->297 306 403a30-403a59 call 403c80 call 405c97 296->306 302 403a25-403a2b lstrcatW 297->302 303 403a0f-403a20 call 406188 297->303 302->306 303->302 311 403aeb-403af3 call 405c97 306->311 312 403a5f-403a64 306->312 318 403b01-403b26 LoadImageW 311->318 319 403af5-403afc call 4062dc 311->319 312->311 313 403a6a-403a92 call 406188 312->313 313->311 320 403a94-403a98 313->320 322 403ba7-403baf call 40140b 318->322 323 403b28-403b58 RegisterClassW 318->323 319->318 324 403aaa-403ab6 lstrlenW 320->324 325 403a9a-403aa7 call 405bbc 320->325 336 403bb1-403bb4 322->336 337 403bb9-403bc4 call 403c80 322->337 326 403c76 323->326 327 403b5e-403ba2 SystemParametersInfoW CreateWindowExW 323->327 331 403ab8-403ac6 lstrcmpiW 324->331 332 403ade-403ae6 call 405b8f call 4062ba 324->332 325->324 330 403c78-403c7f 326->330 327->322 331->332 335 403ac8-403ad2 GetFileAttributesW 331->335 332->311 339 403ad4-403ad6 335->339 340 403ad8-403ad9 call 405bdb 335->340 336->330 346 403bca-403be4 ShowWindow call 406624 337->346 347 403c4d-403c4e call 4053f5 337->347 339->332 339->340 340->332 352 403bf0-403c02 GetClassInfoW 346->352 353 403be6-403beb call 406624 346->353 351 403c53-403c55 347->351 354 403c57-403c5d 351->354 355 403c6f-403c71 call 40140b 351->355 359 403c04-403c14 GetClassInfoW RegisterClassW 352->359 360 403c1a-403c3d DialogBoxParamW call 40140b 352->360 353->352 354->336 356 403c63-403c6a call 40140b 354->356 355->326 356->336 359->360 364 403c42-403c4b call 4038fa 360->364 364->330
                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                      • Part of subcall function 00406694: GetModuleHandleA.KERNEL32(?,00000020,?,00403401,0000000A), ref: 004066A6
                                                                                                                                                                                                                      • Part of subcall function 00406694: GetProcAddress.KERNEL32(00000000,?), ref: 004066C1
                                                                                                                                                                                                                    • lstrcatW.KERNEL32(004DB000,00450248,80000001,Control Panel\Desktop\ResourceLocale,00000000,00450248,00000000,00000002,004DF000,76233420,004CB000,00000000), ref: 00403A2B
                                                                                                                                                                                                                    • lstrlenW.KERNEL32(Remove folder: ,?,?,?,Remove folder: ,00000000,004CF000,004DB000,00450248,80000001,Control Panel\Desktop\ResourceLocale,00000000,00450248,00000000,00000002,004DF000), ref: 00403AAB
                                                                                                                                                                                                                    • lstrcmpiW.KERNEL32(?,.exe,Remove folder: ,?,?,?,Remove folder: ,00000000,004CF000,004DB000,00450248,80000001,Control Panel\Desktop\ResourceLocale,00000000,00450248,00000000), ref: 00403ABE
                                                                                                                                                                                                                    • GetFileAttributesW.KERNEL32(Remove folder: ), ref: 00403AC9
                                                                                                                                                                                                                    • LoadImageW.USER32(00000067,00000001,00000000,00000000,00008040,004CF000), ref: 00403B12
                                                                                                                                                                                                                      • Part of subcall function 00406201: wsprintfW.USER32 ref: 0040620E
                                                                                                                                                                                                                    • RegisterClassW.USER32(00472E80), ref: 00403B4F
                                                                                                                                                                                                                    • SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 00403B67
                                                                                                                                                                                                                    • CreateWindowExW.USER32(00000080,_Nb,00000000,80000000,?,?,?,?,00000000,00000000,00000000), ref: 00403B9C
                                                                                                                                                                                                                    • ShowWindow.USER32(00000005,00000000), ref: 00403BD2
                                                                                                                                                                                                                    • GetClassInfoW.USER32(00000000,RichEdit20W,00472E80), ref: 00403BFE
                                                                                                                                                                                                                    • GetClassInfoW.USER32(00000000,RichEdit,00472E80), ref: 00403C0B
                                                                                                                                                                                                                    • RegisterClassW.USER32(00472E80), ref: 00403C14
                                                                                                                                                                                                                    • DialogBoxParamW.USER32(?,00000000,00403D58,00000000), ref: 00403C33
                                                                                                                                                                                                                    Strings
                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                    • Source File: 00000000.00000002.2527338492.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527299574.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527452560.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.0000000000460000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.0000000000464000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2528550754.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                    • Snapshot File: hcaresult_0_2_400000_cMqyGFCQHk.jbxd
                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                    • API ID: Class$Info$RegisterWindow$AddressAttributesCreateDialogFileHandleImageLoadModuleParamParametersProcShowSystemlstrcatlstrcmpilstrlenwsprintf
                                                                                                                                                                                                                    • String ID: .DEFAULT\Control Panel\International$.exe$Control Panel\Desktop\ResourceLocale$Remove folder: $RichEd20$RichEd32$RichEdit$RichEdit20W$_Nb
                                                                                                                                                                                                                    • API String ID: 1975747703-564491471
                                                                                                                                                                                                                    • Opcode ID: f1b2be5f89fac0cbf9958f47fdf3d8daba4c0bfed37b59ff3d0d792caf125e20
                                                                                                                                                                                                                    • Instruction ID: e946f9b6b947081a315c1f95bc525aa973ad4f651662e5f5477bf26fdb3bf1de
                                                                                                                                                                                                                    • Opcode Fuzzy Hash: f1b2be5f89fac0cbf9958f47fdf3d8daba4c0bfed37b59ff3d0d792caf125e20
                                                                                                                                                                                                                    • Instruction Fuzzy Hash: B361C8302407007ED720AF669E45E2B3A6CEB8474AF40417FF985B51E2DBBD5951CB2E
                                                                                                                                                                                                                    Function 004062DC Relevance: 19.5, APIs: 7, Strings: 4, Instructions: 209stringCOMMON
                                                                                                                                                                                                                    Download Yara Rule

                                                                                                                                                                                                                    Control-flow Graph

                                                                                                                                                                                                                    • Executed
                                                                                                                                                                                                                    • Not Executed
                                                                                                                                                                                                                    control_flow_graph 367 4062dc-4062e7 368 4062e9-4062f8 367->368 369 4062fa-406310 367->369 368->369 370 406316-406323 369->370 371 406528-40652e 369->371 370->371 374 406329-406330 370->374 372 406534-40653f 371->372 373 406335-406342 371->373 376 406541-406545 call 4062ba 372->376 377 40654a-40654b 372->377 373->372 375 406348-406354 373->375 374->371 378 406515 375->378 379 40635a-406398 375->379 376->377 383 406523-406526 378->383 384 406517-406521 378->384 381 4064b8-4064bc 379->381 382 40639e-4063a9 379->382 387 4064be-4064c4 381->387 388 4064ef-4064f3 381->388 385 4063c2 382->385 386 4063ab-4063b0 382->386 383->371 384->371 392 4063c9-4063d0 385->392 386->385 389 4063b2-4063b5 386->389 390 4064d4-4064e0 call 4062ba 387->390 391 4064c6-4064d2 call 406201 387->391 393 406502-406513 lstrlenW 388->393 394 4064f5-4064fd call 4062dc 388->394 389->385 396 4063b7-4063ba 389->396 405 4064e5-4064eb 390->405 391->405 398 4063d2-4063d4 392->398 399 4063d5-4063d7 392->399 393->371 394->393 396->385 401 4063bc-4063c0 396->401 398->399 403 406412-406415 399->403 404 4063d9-406400 call 406188 399->404 401->392 406 406425-406428 403->406 407 406417-406423 GetSystemDirectoryW 403->407 417 4064a0-4064a3 404->417 418 406406-40640d call 4062dc 404->418 405->393 409 4064ed 405->409 411 406493-406495 406->411 412 40642a-406438 GetWindowsDirectoryW 406->412 410 406497-40649b 407->410 414 4064b0-4064b6 call 40654e 409->414 410->414 419 40649d 410->419 411->410 416 40643a-406444 411->416 412->411 414->393 422 406446-406449 416->422 423 40645e-406474 SHGetSpecialFolderLocation 416->423 417->414 420 4064a5-4064ab lstrcatW 417->420 418->410 419->417 420->414 422->423 426 40644b-406452 422->426 427 406476-40648d SHGetPathFromIDListW CoTaskMemFree 423->427 428 40648f 423->428 429 40645a-40645c 426->429 427->410 427->428 428->411 429->410 429->423
                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                    • GetSystemDirectoryW.KERNEL32(Remove folder: ,00002000), ref: 0040641D
                                                                                                                                                                                                                    • GetWindowsDirectoryW.KERNEL32(Remove folder: ,00002000,00000000,Remove folder: C:\Users\user\AppData\Local\Temp\nshFAEA.tmp\,?,00405359,Remove folder: C:\Users\user\AppData\Local\Temp\nshFAEA.tmp\,00000000), ref: 00406430
                                                                                                                                                                                                                    • SHGetSpecialFolderLocation.SHELL32(00405359,0042E100,00000000,Remove folder: C:\Users\user\AppData\Local\Temp\nshFAEA.tmp\,?,00405359,Remove folder: C:\Users\user\AppData\Local\Temp\nshFAEA.tmp\,00000000), ref: 0040646C
                                                                                                                                                                                                                    • SHGetPathFromIDListW.SHELL32(0042E100,Remove folder: ), ref: 0040647A
                                                                                                                                                                                                                    • CoTaskMemFree.OLE32(0042E100), ref: 00406485
                                                                                                                                                                                                                    • lstrcatW.KERNEL32(Remove folder: ,\Microsoft\Internet Explorer\Quick Launch), ref: 004064AB
                                                                                                                                                                                                                    • lstrlenW.KERNEL32(Remove folder: ,00000000,Remove folder: C:\Users\user\AppData\Local\Temp\nshFAEA.tmp\,?,00405359,Remove folder: C:\Users\user\AppData\Local\Temp\nshFAEA.tmp\,00000000), ref: 00406503
                                                                                                                                                                                                                    Strings
                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                    • Source File: 00000000.00000002.2527338492.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527299574.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527452560.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.0000000000460000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.0000000000464000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2528550754.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                    • Snapshot File: hcaresult_0_2_400000_cMqyGFCQHk.jbxd
                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                    • API ID: Directory$FolderFreeFromListLocationPathSpecialSystemTaskWindowslstrcatlstrlen
                                                                                                                                                                                                                    • String ID: Remove folder: $Remove folder: C:\Users\user\AppData\Local\Temp\nshFAEA.tmp\$Software\Microsoft\Windows\CurrentVersion$\Microsoft\Internet Explorer\Quick Launch
                                                                                                                                                                                                                    • API String ID: 717251189-1220960980
                                                                                                                                                                                                                    • Opcode ID: 412c271bb9d070f278564469311d6f605cf1b48e62db3e13451b1dc2679c3c4f
                                                                                                                                                                                                                    • Instruction ID: deb4280fb9253f119c0dee44fead77f8699473dbe43bed35a1e393a154a8df3c
                                                                                                                                                                                                                    • Opcode Fuzzy Hash: 412c271bb9d070f278564469311d6f605cf1b48e62db3e13451b1dc2679c3c4f
                                                                                                                                                                                                                    • Instruction Fuzzy Hash: 87612371A00115AADF209F64DC44BAE37A5EF45318F22803FE907B62D0D77D9AA1C75E
                                                                                                                                                                                                                    Function 00402EDD Relevance: 17.7, APIs: 5, Strings: 5, Instructions: 182COMMON
                                                                                                                                                                                                                    Download Yara Rule

                                                                                                                                                                                                                    Control-flow Graph

                                                                                                                                                                                                                    • Executed
                                                                                                                                                                                                                    • Not Executed
                                                                                                                                                                                                                    control_flow_graph 430 402edd-402f2b GetTickCount GetModuleFileNameW call 405db0 433 402f37-402f65 call 4062ba call 405bdb call 4062ba GetFileSize 430->433 434 402f2d-402f32 430->434 442 403052-403060 call 402e79 433->442 443 402f6b 433->443 435 40310f-403113 434->435 449 403062-403065 442->449 450 4030b5-4030ba 442->450 445 402f70-402f87 443->445 447 402f89 445->447 448 402f8b-402f94 call 403331 445->448 447->448 456 402f9a-402fa1 448->456 457 4030bc-4030c4 call 402e79 448->457 452 403067-40307f call 403347 call 403331 449->452 453 403089-4030b3 GlobalAlloc call 403347 call 403116 449->453 450->435 452->450 478 403081-403087 452->478 453->450 476 4030c6-4030d7 453->476 461 402fa3-402fb7 call 405d6b 456->461 462 40301d-403021 456->462 457->450 467 40302b-403031 461->467 481 402fb9-402fc0 461->481 466 403023-40302a call 402e79 462->466 462->467 466->467 473 403040-40304a 467->473 474 403033-40303d call 406787 467->474 473->445 477 403050 473->477 474->473 483 4030d9 476->483 484 4030df-4030e4 476->484 477->442 478->450 478->453 481->467 482 402fc2-402fc9 481->482 482->467 486 402fcb-402fd2 482->486 483->484 487 4030e5-4030eb 484->487 486->467 488 402fd4-402fdb 486->488 487->487 489 4030ed-403108 SetFilePointer call 405d6b 487->489 488->467 490 402fdd-402ffd 488->490 493 40310d 489->493 490->450 492 403003-403007 490->492 494 403009-40300d 492->494 495 40300f-403017 492->495 493->435 494->477 494->495 495->467 496 403019-40301b 495->496 496->467
                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                    • GetTickCount.KERNEL32 ref: 00402EEE
                                                                                                                                                                                                                    • GetModuleFileNameW.KERNEL32(00000000,004E7000,00002000,?,00000006,00000008,0000000A), ref: 00402F0A
                                                                                                                                                                                                                      • Part of subcall function 00405DB0: GetFileAttributesW.KERNELBASE(004E7000,00402F1D,004E7000,80000000,00000003,?,00000006,00000008,0000000A), ref: 00405DB4
                                                                                                                                                                                                                      • Part of subcall function 00405DB0: CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000,?,00000006,00000008,0000000A), ref: 00405DD6
                                                                                                                                                                                                                    • GetFileSize.KERNEL32(00000000,00000000,004EB000,00000000,004D7000,004D7000,004E7000,004E7000,80000000,00000003,?,00000006,00000008,0000000A), ref: 00402F56
                                                                                                                                                                                                                    Strings
                                                                                                                                                                                                                    • Error launching installer, xrefs: 00402F2D
                                                                                                                                                                                                                    • Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author , xrefs: 004030B5
                                                                                                                                                                                                                    • Null, xrefs: 00402FD4
                                                                                                                                                                                                                    • soft, xrefs: 00402FCB
                                                                                                                                                                                                                    • Inst, xrefs: 00402FC2
                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                    • Source File: 00000000.00000002.2527338492.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527299574.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527452560.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.0000000000460000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.0000000000464000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2528550754.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                    • Snapshot File: hcaresult_0_2_400000_cMqyGFCQHk.jbxd
                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                    • API ID: File$AttributesCountCreateModuleNameSizeTick
                                                                                                                                                                                                                    • String ID: Error launching installer$Inst$Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author $Null$soft
                                                                                                                                                                                                                    • API String ID: 4283519449-527102705
                                                                                                                                                                                                                    • Opcode ID: b6f6648de98c24fa7c04dbba87c1fded15afc009f9c9acd1abae5bab2567aa71
                                                                                                                                                                                                                    • Instruction ID: d807cc789e5c0b6659aec278a7977cb1897ccc82e3fedab9e592eb30a9b28e48
                                                                                                                                                                                                                    • Opcode Fuzzy Hash: b6f6648de98c24fa7c04dbba87c1fded15afc009f9c9acd1abae5bab2567aa71
                                                                                                                                                                                                                    • Instruction Fuzzy Hash: 23511671901205ABDB20AF61DD85B9F7FACEB0431AF20403BF914B62D5C7789E818B9D
                                                                                                                                                                                                                    Function 0040176F Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 145stringtimeCOMMON
                                                                                                                                                                                                                    Download Yara Rule

                                                                                                                                                                                                                    Control-flow Graph

                                                                                                                                                                                                                    • Executed
                                                                                                                                                                                                                    • Not Executed
                                                                                                                                                                                                                    control_flow_graph 561 40176f-401794 call 402c41 call 405c06 566 401796-40179c call 4062ba 561->566 567 40179e-4017b0 call 4062ba call 405b8f lstrcatW 561->567 572 4017b5-4017b6 call 40654e 566->572 567->572 576 4017bb-4017bf 572->576 577 4017c1-4017cb call 4065fd 576->577 578 4017f2-4017f5 576->578 586 4017dd-4017ef 577->586 587 4017cd-4017db CompareFileTime 577->587 580 4017f7-4017f8 call 405d8b 578->580 581 4017fd-401819 call 405db0 578->581 580->581 588 40181b-40181e 581->588 589 40188d-4018b6 call 405322 call 403116 581->589 586->578 587->586 590 401820-40185e call 4062ba * 2 call 4062dc call 4062ba call 405920 588->590 591 40186f-401879 call 405322 588->591 603 4018b8-4018bc 589->603 604 4018be-4018ca SetFileTime 589->604 590->576 623 401864-401865 590->623 601 401882-401888 591->601 605 402ace 601->605 603->604 607 4018d0-4018db CloseHandle 603->607 604->607 611 402ad0-402ad4 605->611 608 4018e1-4018e4 607->608 609 402ac5-402ac8 607->609 612 4018e6-4018f7 call 4062dc lstrcatW 608->612 613 4018f9-4018fc call 4062dc 608->613 609->605 619 401901-4022fc call 405920 612->619 613->619 619->609 619->611 623->601 625 401867-401868 623->625 625->591
                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                    • lstrcatW.KERNEL32(00000000,00000000,ExecShellAsUser,004D3000,?,?,00000031), ref: 004017B0
                                                                                                                                                                                                                    • CompareFileTime.KERNEL32(-00000014,?,ExecShellAsUser,ExecShellAsUser,00000000,00000000,ExecShellAsUser,004D3000,?,?,00000031), ref: 004017D5
                                                                                                                                                                                                                      • Part of subcall function 004062BA: lstrcpynW.KERNEL32(?,?,00002000,00403460,00472EE0,NSIS Error,?,00000006,00000008,0000000A), ref: 004062C7
                                                                                                                                                                                                                      • Part of subcall function 00405322: lstrlenW.KERNEL32(Remove folder: C:\Users\user\AppData\Local\Temp\nshFAEA.tmp\,00000000,0042E100,762323A0,?,?,?,?,?,?,?,?,?,0040327A,00000000,?), ref: 0040535A
                                                                                                                                                                                                                      • Part of subcall function 00405322: lstrlenW.KERNEL32(0040327A,Remove folder: C:\Users\user\AppData\Local\Temp\nshFAEA.tmp\,00000000,0042E100,762323A0,?,?,?,?,?,?,?,?,?,0040327A,00000000), ref: 0040536A
                                                                                                                                                                                                                      • Part of subcall function 00405322: lstrcatW.KERNEL32(Remove folder: C:\Users\user\AppData\Local\Temp\nshFAEA.tmp\,0040327A,0040327A,Remove folder: C:\Users\user\AppData\Local\Temp\nshFAEA.tmp\,00000000,0042E100,762323A0), ref: 0040537D
                                                                                                                                                                                                                      • Part of subcall function 00405322: SetWindowTextW.USER32(Remove folder: C:\Users\user\AppData\Local\Temp\nshFAEA.tmp\,Remove folder: C:\Users\user\AppData\Local\Temp\nshFAEA.tmp\), ref: 0040538F
                                                                                                                                                                                                                      • Part of subcall function 00405322: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 004053B5
                                                                                                                                                                                                                      • Part of subcall function 00405322: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 004053CF
                                                                                                                                                                                                                      • Part of subcall function 00405322: SendMessageW.USER32(?,00001013,?,00000000), ref: 004053DD
                                                                                                                                                                                                                    Strings
                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                    • Source File: 00000000.00000002.2527338492.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527299574.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527452560.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.0000000000460000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.0000000000464000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2528550754.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                    • Snapshot File: hcaresult_0_2_400000_cMqyGFCQHk.jbxd
                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                    • API ID: MessageSend$lstrcatlstrlen$CompareFileTextTimeWindowlstrcpyn
                                                                                                                                                                                                                    • String ID: C:\Users\user\AppData\Local\Temp\nshFAEA.tmp$C:\Users\user\AppData\Local\Temp\nshFAEA.tmp\StdUtils.dll$ExecShellAsUser
                                                                                                                                                                                                                    • API String ID: 1941528284-3477368419
                                                                                                                                                                                                                    • Opcode ID: ef34b70ba7e76013f08a8010c699c1fb49796a167d53f933b8375716ae072387
                                                                                                                                                                                                                    • Instruction ID: c6e8234c1d4b6e0ef99598e998ad36802638a9a190aaa2bd7459f070bf199d51
                                                                                                                                                                                                                    • Opcode Fuzzy Hash: ef34b70ba7e76013f08a8010c699c1fb49796a167d53f933b8375716ae072387
                                                                                                                                                                                                                    • Instruction Fuzzy Hash: 9841B471900514BACF107BA5CD45DAF3A79EF05368F20423FF422B10E1DA3C86919A6E
                                                                                                                                                                                                                    Function 00406624 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 36libraryCOMMON
                                                                                                                                                                                                                    Download Yara Rule

                                                                                                                                                                                                                    Control-flow Graph

                                                                                                                                                                                                                    • Executed
                                                                                                                                                                                                                    • Not Executed
                                                                                                                                                                                                                    control_flow_graph 627 406624-406644 GetSystemDirectoryW 628 406646 627->628 629 406648-40664a 627->629 628->629 630 40665b-40665d 629->630 631 40664c-406655 629->631 633 40665e-406691 wsprintfW LoadLibraryExW 630->633 631->630 632 406657-406659 631->632 632->633
                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                    • GetSystemDirectoryW.KERNEL32(?,00000104), ref: 0040663B
                                                                                                                                                                                                                    • wsprintfW.USER32 ref: 00406676
                                                                                                                                                                                                                    • LoadLibraryExW.KERNEL32(?,00000000,00000008), ref: 0040668A
                                                                                                                                                                                                                    Strings
                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                    • Source File: 00000000.00000002.2527338492.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527299574.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527452560.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.0000000000460000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.0000000000464000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2528550754.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                    • Snapshot File: hcaresult_0_2_400000_cMqyGFCQHk.jbxd
                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                    • API ID: DirectoryLibraryLoadSystemwsprintf
                                                                                                                                                                                                                    • String ID: %s%S.dll$UXTHEME$\
                                                                                                                                                                                                                    • API String ID: 2200240437-1946221925
                                                                                                                                                                                                                    • Opcode ID: fcd04411c5a1f64f7e9219edfc5ac0d332aa1f587fd7b062781a7321f30925af
                                                                                                                                                                                                                    • Instruction ID: 9fa172bba6ca99a644905d2b6d7ed641771312ed853c50fe9922007c80c3d461
                                                                                                                                                                                                                    • Opcode Fuzzy Hash: fcd04411c5a1f64f7e9219edfc5ac0d332aa1f587fd7b062781a7321f30925af
                                                                                                                                                                                                                    • Instruction Fuzzy Hash: 7CF0FC70501119A6CF10BB64DD0EF9B365CA700304F10447AA54AF10D1EBB9DB64CB99
                                                                                                                                                                                                                    Function 00403116 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 166COMMON
                                                                                                                                                                                                                    Download Yara Rule

                                                                                                                                                                                                                    Control-flow Graph

                                                                                                                                                                                                                    • Executed
                                                                                                                                                                                                                    • Not Executed
                                                                                                                                                                                                                    control_flow_graph 634 403116-40312d 635 403136-40313f 634->635 636 40312f 634->636 637 403141 635->637 638 403148-40314d 635->638 636->635 637->638 639 40315d-40316a call 403331 638->639 640 40314f-403158 call 403347 638->640 644 403170-403174 639->644 645 40331f 639->645 640->639 646 4032ca-4032cc 644->646 647 40317a-4031c3 GetTickCount 644->647 648 403321-403322 645->648 649 40330c-40330f 646->649 650 4032ce-4032d1 646->650 651 403327 647->651 652 4031c9-4031d1 647->652 653 40332a-40332e 648->653 657 403311 649->657 658 403314-40331d call 403331 649->658 650->651 654 4032d3 650->654 651->653 655 4031d3 652->655 656 4031d6-4031e4 call 403331 652->656 659 4032d6-4032dc 654->659 655->656 656->645 668 4031ea-4031f3 656->668 657->658 658->645 666 403324 658->666 663 4032e0-4032ee call 403331 659->663 664 4032de 659->664 663->645 671 4032f0-4032f5 call 405e62 663->671 664->663 666->651 670 4031f9-403219 call 4067f5 668->670 676 4032c2-4032c4 670->676 677 40321f-403232 GetTickCount 670->677 675 4032fa-4032fc 671->675 678 4032c6-4032c8 675->678 679 4032fe-403308 675->679 676->648 680 403234-40323c 677->680 681 40327d-40327f 677->681 678->648 679->659 684 40330a 679->684 685 403244-40327a MulDiv wsprintfW call 405322 680->685 686 40323e-403242 680->686 682 403281-403285 681->682 683 4032b6-4032ba 681->683 688 403287-40328e call 405e62 682->688 689 40329c-4032a7 682->689 683->652 690 4032c0 683->690 684->651 685->681 686->681 686->685 694 403293-403295 688->694 693 4032aa-4032ae 689->693 690->651 693->670 695 4032b4 693->695 694->678 696 403297-40329a 694->696 695->651 696->693
                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                    Strings
                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                    • Source File: 00000000.00000002.2527338492.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527299574.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527452560.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.0000000000460000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.0000000000464000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2528550754.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                    • Snapshot File: hcaresult_0_2_400000_cMqyGFCQHk.jbxd
                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                    • API ID: CountTick$wsprintf
                                                                                                                                                                                                                    • String ID: ... %d%%
                                                                                                                                                                                                                    • API String ID: 551687249-2449383134
                                                                                                                                                                                                                    • Opcode ID: 791be84a4dbf0ce6e2b89685bbb0426d8c944effbebd544c9fcf1485a6d681ca
                                                                                                                                                                                                                    • Instruction ID: f437ad28db75119c3a693f92e670aa5c34007c7df9fe8e0debaece40423bbb79
                                                                                                                                                                                                                    • Opcode Fuzzy Hash: 791be84a4dbf0ce6e2b89685bbb0426d8c944effbebd544c9fcf1485a6d681ca
                                                                                                                                                                                                                    • Instruction Fuzzy Hash: 0D517D71900219DBDB10DF66EA44AAE7BB8AB04356F54417FEC14B72C0CB388A51CBA9
                                                                                                                                                                                                                    Function 00401C1F Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84windowtimeCOMMON
                                                                                                                                                                                                                    Download Yara Rule

                                                                                                                                                                                                                    Control-flow Graph

                                                                                                                                                                                                                    • Executed
                                                                                                                                                                                                                    • Not Executed
                                                                                                                                                                                                                    control_flow_graph 697 401c1f-401c3f call 402c1f * 2 702 401c41-401c48 call 402c41 697->702 703 401c4b-401c4f 697->703 702->703 704 401c51-401c58 call 402c41 703->704 705 401c5b-401c61 703->705 704->705 708 401c63-401c7f call 402c1f * 2 705->708 709 401caf-401cd9 call 402c41 * 2 FindWindowExW 705->709 721 401c81-401c9d SendMessageTimeoutW 708->721 722 401c9f-401cad SendMessageW 708->722 720 401cdf 709->720 723 401ce2-401ce5 720->723 721->723 722->720 724 402ac5-402ad4 723->724 725 401ceb 723->725 725->724
                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                    • SendMessageTimeoutW.USER32(00000000,00000000,?,?,?,00000002,?), ref: 00401C8F
                                                                                                                                                                                                                    • SendMessageW.USER32(00000000,00000000,?,?), ref: 00401CA7
                                                                                                                                                                                                                    Strings
                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                    • Source File: 00000000.00000002.2527338492.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527299574.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527452560.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.0000000000460000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.0000000000464000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2528550754.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                    • Snapshot File: hcaresult_0_2_400000_cMqyGFCQHk.jbxd
                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                    • API ID: MessageSend$Timeout
                                                                                                                                                                                                                    • String ID: !
                                                                                                                                                                                                                    • API String ID: 1777923405-2657877971
                                                                                                                                                                                                                    • Opcode ID: 3fb84e4798befa08d55ab41dd677560f87883767086f956b8989b4831fa63046
                                                                                                                                                                                                                    • Instruction ID: 1af55e8da281c8781352e9764615226c40e2312ccaecb42dabcb88ef8baddf82
                                                                                                                                                                                                                    • Opcode Fuzzy Hash: 3fb84e4798befa08d55ab41dd677560f87883767086f956b8989b4831fa63046
                                                                                                                                                                                                                    • Instruction Fuzzy Hash: 5621C371948209AEEF049FB5DE4AABE7BB4EF84304F14443EF605B61D0D7B889809B19
                                                                                                                                                                                                                    Function 004023E4 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 64registrystringCOMMON
                                                                                                                                                                                                                    Download Yara Rule

                                                                                                                                                                                                                    Control-flow Graph

                                                                                                                                                                                                                    • Executed
                                                                                                                                                                                                                    • Not Executed
                                                                                                                                                                                                                    control_flow_graph 728 4023e4-402415 call 402c41 * 2 call 402cd1 735 402ac5-402ad4 728->735 736 40241b-402425 728->736 737 402427-402434 call 402c41 lstrlenW 736->737 738 402438-40243b 736->738 737->738 740 40243d-40244e call 402c1f 738->740 741 40244f-402452 738->741 740->741 745 402463-402477 RegSetValueExW 741->745 746 402454-40245e call 403116 741->746 750 402479 745->750 751 40247c-40255d RegCloseKey 745->751 746->745 750->751 751->735
                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                    • lstrlenW.KERNEL32(C:\Users\user\AppData\Local\Temp\nshFAEA.tmp,00000023,00000011,00000002), ref: 0040242F
                                                                                                                                                                                                                    • RegSetValueExW.KERNELBASE(?,?,?,?,C:\Users\user\AppData\Local\Temp\nshFAEA.tmp,00000000,00000011,00000002), ref: 0040246F
                                                                                                                                                                                                                    • RegCloseKey.ADVAPI32(?,?,?,C:\Users\user\AppData\Local\Temp\nshFAEA.tmp,00000000,00000011,00000002), ref: 00402557
                                                                                                                                                                                                                    Strings
                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                    • Source File: 00000000.00000002.2527338492.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527299574.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527452560.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.0000000000460000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.0000000000464000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2528550754.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                    • Snapshot File: hcaresult_0_2_400000_cMqyGFCQHk.jbxd
                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                    • API ID: CloseValuelstrlen
                                                                                                                                                                                                                    • String ID: C:\Users\user\AppData\Local\Temp\nshFAEA.tmp
                                                                                                                                                                                                                    • API String ID: 2655323295-2372997001
                                                                                                                                                                                                                    • Opcode ID: 108721b550a48034b2014e23eab57ec1314cfbc5d5ef1d2255c6534627125d58
                                                                                                                                                                                                                    • Instruction ID: a703f9f7a84a81219e2528cb215680d2185ac4e531b753f9c0eacf199e84c27d
                                                                                                                                                                                                                    • Opcode Fuzzy Hash: 108721b550a48034b2014e23eab57ec1314cfbc5d5ef1d2255c6534627125d58
                                                                                                                                                                                                                    • Instruction Fuzzy Hash: AF118471D00104BEEB10AFA5DE89EAEBA74AB44754F11803BF504F71D1D7F48D409B29
                                                                                                                                                                                                                    Function 004057F1 Relevance: 6.0, APIs: 4, Instructions: 39COMMON
                                                                                                                                                                                                                    Download Yara Rule

                                                                                                                                                                                                                    Control-flow Graph

                                                                                                                                                                                                                    • Executed
                                                                                                                                                                                                                    • Not Executed
                                                                                                                                                                                                                    control_flow_graph 753 4057f1-40583c CreateDirectoryW 754 405842-40584f GetLastError 753->754 755 40583e-405840 753->755 756 405869-40586b 754->756 757 405851-405865 SetFileSecurityW 754->757 755->756 757->755 758 405867 GetLastError 757->758 758->756
                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                    • CreateDirectoryW.KERNELBASE(?,?,00000000), ref: 00405834
                                                                                                                                                                                                                    • GetLastError.KERNEL32 ref: 00405848
                                                                                                                                                                                                                    • SetFileSecurityW.ADVAPI32(?,80000007,00000001), ref: 0040585D
                                                                                                                                                                                                                    • GetLastError.KERNEL32 ref: 00405867
                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                    • Source File: 00000000.00000002.2527338492.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527299574.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527452560.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.0000000000460000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.0000000000464000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2528550754.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                    • Snapshot File: hcaresult_0_2_400000_cMqyGFCQHk.jbxd
                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                    • API ID: ErrorLast$CreateDirectoryFileSecurity
                                                                                                                                                                                                                    • String ID:
                                                                                                                                                                                                                    • API String ID: 3449924974-0
                                                                                                                                                                                                                    • Opcode ID: 817c7eeb2e6ade2cce28f3b9d2e4670c9c7091e2f59c9eba6f9578a5288f1365
                                                                                                                                                                                                                    • Instruction ID: d156970015101e62572267df52bf1fb018b172c5ebb67f048bc3511340661aba
                                                                                                                                                                                                                    • Opcode Fuzzy Hash: 817c7eeb2e6ade2cce28f3b9d2e4670c9c7091e2f59c9eba6f9578a5288f1365
                                                                                                                                                                                                                    • Instruction Fuzzy Hash: EB010872D00219EADF009FA1C944BEFBBB8EF14304F00803AE945B6280D7789618CFA9
                                                                                                                                                                                                                    Function 00405C97 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 47stringCOMMON
                                                                                                                                                                                                                    Download Yara Rule

                                                                                                                                                                                                                    Control-flow Graph

                                                                                                                                                                                                                    • Executed
                                                                                                                                                                                                                    • Not Executed
                                                                                                                                                                                                                    control_flow_graph 759 405c97-405cb2 call 4062ba call 405c3a 764 405cb4-405cb6 759->764 765 405cb8-405cc5 call 40654e 759->765 766 405d10-405d12 764->766 769 405cd5-405cd9 765->769 770 405cc7-405ccd 765->770 772 405cef-405cf8 lstrlenW 769->772 770->764 771 405ccf-405cd3 770->771 771->764 771->769 773 405cfa-405d0e call 405b8f GetFileAttributesW 772->773 774 405cdb-405ce2 call 4065fd 772->774 773->766 779 405ce4-405ce7 774->779 780 405ce9-405cea call 405bdb 774->780 779->764 779->780 780->772
                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                      • Part of subcall function 004062BA: lstrcpynW.KERNEL32(?,?,00002000,00403460,00472EE0,NSIS Error,?,00000006,00000008,0000000A), ref: 004062C7
                                                                                                                                                                                                                      • Part of subcall function 00405C3A: CharNextW.USER32(?,?,C:\,?,00405CAE,C:\,C:\,004DF000,?,76233420,004059EC,?,004DF000,76233420,00000000), ref: 00405C48
                                                                                                                                                                                                                      • Part of subcall function 00405C3A: CharNextW.USER32(00000000), ref: 00405C4D
                                                                                                                                                                                                                      • Part of subcall function 00405C3A: CharNextW.USER32(00000000), ref: 00405C65
                                                                                                                                                                                                                    • lstrlenW.KERNEL32(C:\,00000000,C:\,C:\,004DF000,?,76233420,004059EC,?,004DF000,76233420,00000000), ref: 00405CF0
                                                                                                                                                                                                                    • GetFileAttributesW.KERNELBASE(C:\,C:\,C:\,C:\,C:\,C:\,00000000,C:\,C:\,004DF000,?,76233420,004059EC,?,004DF000,76233420), ref: 00405D00
                                                                                                                                                                                                                    Strings
                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                    • Source File: 00000000.00000002.2527338492.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527299574.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527452560.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.0000000000460000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.0000000000464000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2528550754.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                    • Snapshot File: hcaresult_0_2_400000_cMqyGFCQHk.jbxd
                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                    • API ID: CharNext$AttributesFilelstrcpynlstrlen
                                                                                                                                                                                                                    • String ID: C:\
                                                                                                                                                                                                                    • API String ID: 3248276644-3404278061
                                                                                                                                                                                                                    • Opcode ID: 1236b3014a845ece28ca986cac263987dd07c4e4a123605a37d0802bd6a8cdf3
                                                                                                                                                                                                                    • Instruction ID: 4e01e145a0ed536ad24acc563e8a85444835dd946e40d448b56664b374cc0476
                                                                                                                                                                                                                    • Opcode Fuzzy Hash: 1236b3014a845ece28ca986cac263987dd07c4e4a123605a37d0802bd6a8cdf3
                                                                                                                                                                                                                    • Instruction Fuzzy Hash: 21F0F43500DF6125F626333A1C45AAF2555CE82328B6A057FFC62B12D2DA3C89539D7E
                                                                                                                                                                                                                    Function 00405DDF Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37COMMON
                                                                                                                                                                                                                    Download Yara Rule

                                                                                                                                                                                                                    Control-flow Graph

                                                                                                                                                                                                                    • Executed
                                                                                                                                                                                                                    • Not Executed
                                                                                                                                                                                                                    control_flow_graph 782 405ddf-405deb 783 405dec-405e20 GetTickCount GetTempFileNameW 782->783 784 405e22-405e24 783->784 785 405e2f-405e31 783->785 784->783 786 405e26 784->786 787 405e29-405e2c 785->787 786->787
                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                    • GetTickCount.KERNEL32 ref: 00405DFD
                                                                                                                                                                                                                    • GetTempFileNameW.KERNELBASE(?,?,00000000,?,?,?,004CB000,0040338D,004DB000,004DF000,004DF000,004DF000,004DF000,004DF000,76233420,004035D9), ref: 00405E18
                                                                                                                                                                                                                    Strings
                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                    • Source File: 00000000.00000002.2527338492.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527299574.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527452560.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.0000000000460000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.0000000000464000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2528550754.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                    • Snapshot File: hcaresult_0_2_400000_cMqyGFCQHk.jbxd
                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                    • API ID: CountFileNameTempTick
                                                                                                                                                                                                                    • String ID: nsa
                                                                                                                                                                                                                    • API String ID: 1716503409-2209301699
                                                                                                                                                                                                                    • Opcode ID: 579317ece081e1c49d3b274132234632dc0f80c8b4471fc5797a0d742f25062f
                                                                                                                                                                                                                    • Instruction ID: af8b6ba947558e1b0daa3aed001b6e0f80e178ffca66ecedc63f3e0829e9a41e
                                                                                                                                                                                                                    • Opcode Fuzzy Hash: 579317ece081e1c49d3b274132234632dc0f80c8b4471fc5797a0d742f25062f
                                                                                                                                                                                                                    • Instruction Fuzzy Hash: 61F03076A00304FBEB009F69ED05E9FB7BCEB95710F10803AE941E7250E6B09A548B64
                                                                                                                                                                                                                    Function 00402032 Relevance: 4.6, APIs: 3, Instructions: 73libraryCOMMON
                                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                    • GetModuleHandleW.KERNELBASE(00000000,00000001,000000F0), ref: 0040205D
                                                                                                                                                                                                                      • Part of subcall function 00405322: lstrlenW.KERNEL32(Remove folder: C:\Users\user\AppData\Local\Temp\nshFAEA.tmp\,00000000,0042E100,762323A0,?,?,?,?,?,?,?,?,?,0040327A,00000000,?), ref: 0040535A
                                                                                                                                                                                                                      • Part of subcall function 00405322: lstrlenW.KERNEL32(0040327A,Remove folder: C:\Users\user\AppData\Local\Temp\nshFAEA.tmp\,00000000,0042E100,762323A0,?,?,?,?,?,?,?,?,?,0040327A,00000000), ref: 0040536A
                                                                                                                                                                                                                      • Part of subcall function 00405322: lstrcatW.KERNEL32(Remove folder: C:\Users\user\AppData\Local\Temp\nshFAEA.tmp\,0040327A,0040327A,Remove folder: C:\Users\user\AppData\Local\Temp\nshFAEA.tmp\,00000000,0042E100,762323A0), ref: 0040537D
                                                                                                                                                                                                                      • Part of subcall function 00405322: SetWindowTextW.USER32(Remove folder: C:\Users\user\AppData\Local\Temp\nshFAEA.tmp\,Remove folder: C:\Users\user\AppData\Local\Temp\nshFAEA.tmp\), ref: 0040538F
                                                                                                                                                                                                                      • Part of subcall function 00405322: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 004053B5
                                                                                                                                                                                                                      • Part of subcall function 00405322: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 004053CF
                                                                                                                                                                                                                      • Part of subcall function 00405322: SendMessageW.USER32(?,00001013,?,00000000), ref: 004053DD
                                                                                                                                                                                                                    • LoadLibraryExW.KERNEL32(00000000,?,00000008,00000001,000000F0), ref: 0040206E
                                                                                                                                                                                                                    • FreeLibrary.KERNELBASE(?,?,000000F7,?,?,00000008,00000001,000000F0), ref: 004020EB
                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                    • Source File: 00000000.00000002.2527338492.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527299574.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527452560.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.0000000000460000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.0000000000464000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2528550754.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                    • Snapshot File: hcaresult_0_2_400000_cMqyGFCQHk.jbxd
                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                    • API ID: MessageSend$Librarylstrlen$FreeHandleLoadModuleTextWindowlstrcat
                                                                                                                                                                                                                    • String ID:
                                                                                                                                                                                                                    • API String ID: 334405425-0
                                                                                                                                                                                                                    • Opcode ID: 72a5e19f9697d1318c9a310d29b5b60265bfdb2e952e74c10cb73e1909f0eb38
                                                                                                                                                                                                                    • Instruction ID: 3abd81b96889d1c7eb1cceed2e7b5e281284f1a6e6a9a5ff44b88a827c8e1d1c
                                                                                                                                                                                                                    • Opcode Fuzzy Hash: 72a5e19f9697d1318c9a310d29b5b60265bfdb2e952e74c10cb73e1909f0eb38
                                                                                                                                                                                                                    • Instruction Fuzzy Hash: 8821B071D00205AACF20AFA5CE48A9E7A70BF04358F60413BF511B11E0DBBD8981DA6E
                                                                                                                                                                                                                    Function 00401B77 Relevance: 4.6, APIs: 2, Strings: 1, Instructions: 72memoryCOMMON
                                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                    • GlobalFree.KERNELBASE(007145B0), ref: 00401BE7
                                                                                                                                                                                                                    • GlobalAlloc.KERNELBASE(00000040,00004004), ref: 00401BF9
                                                                                                                                                                                                                    Strings
                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                    • Source File: 00000000.00000002.2527338492.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527299574.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527452560.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.0000000000460000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.0000000000464000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2528550754.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                    • Snapshot File: hcaresult_0_2_400000_cMqyGFCQHk.jbxd
                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                    • API ID: Global$AllocFree
                                                                                                                                                                                                                    • String ID: ExecShellAsUser
                                                                                                                                                                                                                    • API String ID: 3394109436-869331269
                                                                                                                                                                                                                    • Opcode ID: 0ee5b69d2cfb3a0a2e0f3aae0319e9b1983c649d140d642359d16bc307d41886
                                                                                                                                                                                                                    • Instruction ID: 2ffc4b8e8b305263ff1bfe934f744a2e7f0909984677ca7ca3d2d917788d1148
                                                                                                                                                                                                                    • Opcode Fuzzy Hash: 0ee5b69d2cfb3a0a2e0f3aae0319e9b1983c649d140d642359d16bc307d41886
                                                                                                                                                                                                                    • Instruction Fuzzy Hash: 52210A76600100ABCB10FF95CE8499E73A8EB48318BA4443FF506F32D0DB78A852DB6D
                                                                                                                                                                                                                    Function 00402259 Relevance: 4.6, APIs: 3, Instructions: 51stringCOMMON
                                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                      • Part of subcall function 004065FD: FindFirstFileW.KERNELBASE(004DF000,00468298,C:\,00405CE0,C:\,C:\,00000000,C:\,C:\,004DF000,?,76233420,004059EC,?,004DF000,76233420), ref: 00406608
                                                                                                                                                                                                                      • Part of subcall function 004065FD: FindClose.KERNELBASE(00000000), ref: 00406614
                                                                                                                                                                                                                    • lstrlenW.KERNEL32 ref: 00402299
                                                                                                                                                                                                                    • lstrlenW.KERNEL32(00000000), ref: 004022A4
                                                                                                                                                                                                                    • SHFileOperationW.SHELL32(?,?,?,00000000), ref: 004022CD
                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                    • Source File: 00000000.00000002.2527338492.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527299574.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527452560.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.0000000000460000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.0000000000464000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2528550754.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                    • Snapshot File: hcaresult_0_2_400000_cMqyGFCQHk.jbxd
                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                    • API ID: FileFindlstrlen$CloseFirstOperation
                                                                                                                                                                                                                    • String ID:
                                                                                                                                                                                                                    • API String ID: 1486964399-0
                                                                                                                                                                                                                    • Opcode ID: 29d6f0bed4bd2d50b69dd1226e545e03bb95794d8620927361660d91590f24b0
                                                                                                                                                                                                                    • Instruction ID: edc96df04b91ed766a503f65766f364d086ea8d205cfe5bb15309c141496b913
                                                                                                                                                                                                                    • Opcode Fuzzy Hash: 29d6f0bed4bd2d50b69dd1226e545e03bb95794d8620927361660d91590f24b0
                                                                                                                                                                                                                    • Instruction Fuzzy Hash: 57117071900318A6DB10EFF98E4999EB7B8AF04344F50443FB805F72D1D6B8C4419B59
                                                                                                                                                                                                                    Function 00405984 Relevance: 4.5, APIs: 3, Instructions: 28fileCOMMON
                                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                      • Part of subcall function 00405D8B: GetFileAttributesW.KERNELBASE(?,?,00405990,?,?,00000000,00405B66,?,?,?,?), ref: 00405D90
                                                                                                                                                                                                                      • Part of subcall function 00405D8B: SetFileAttributesW.KERNELBASE(?,00000000), ref: 00405DA4
                                                                                                                                                                                                                    • RemoveDirectoryW.KERNELBASE(?,?,?,00000000,00405B66), ref: 0040599F
                                                                                                                                                                                                                    • DeleteFileW.KERNELBASE(?,?,?,00000000,00405B66), ref: 004059A7
                                                                                                                                                                                                                    • SetFileAttributesW.KERNEL32(?,00000000), ref: 004059BF
                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                    • Source File: 00000000.00000002.2527338492.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527299574.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527452560.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.0000000000460000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.0000000000464000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2528550754.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                    • Snapshot File: hcaresult_0_2_400000_cMqyGFCQHk.jbxd
                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                    • API ID: File$Attributes$DeleteDirectoryRemove
                                                                                                                                                                                                                    • String ID:
                                                                                                                                                                                                                    • API String ID: 1655745494-0
                                                                                                                                                                                                                    • Opcode ID: 280825f6b60181aa2d378306bbdc3da53de5ab3d89a200e418c4f7b9ea6af3cc
                                                                                                                                                                                                                    • Instruction ID: 825022a906987a8d14f11fb4079f6fb6242afe5a54bc5f1377d2c32e3c215ab4
                                                                                                                                                                                                                    • Opcode Fuzzy Hash: 280825f6b60181aa2d378306bbdc3da53de5ab3d89a200e418c4f7b9ea6af3cc
                                                                                                                                                                                                                    • Instruction Fuzzy Hash: D1E0E5B1119F5096D21067349A0CB5B2AA4DF86334F05093AF891F11C0DB3844068EBE
                                                                                                                                                                                                                    Function 004015C1 Relevance: 3.1, APIs: 2, Instructions: 65COMMON
                                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                      • Part of subcall function 00405C3A: CharNextW.USER32(?,?,C:\,?,00405CAE,C:\,C:\,004DF000,?,76233420,004059EC,?,004DF000,76233420,00000000), ref: 00405C48
                                                                                                                                                                                                                      • Part of subcall function 00405C3A: CharNextW.USER32(00000000), ref: 00405C4D
                                                                                                                                                                                                                      • Part of subcall function 00405C3A: CharNextW.USER32(00000000), ref: 00405C65
                                                                                                                                                                                                                    • GetFileAttributesW.KERNELBASE(?,?,00000000,0000005C,00000000,000000F0), ref: 0040161A
                                                                                                                                                                                                                      • Part of subcall function 004057F1: CreateDirectoryW.KERNELBASE(?,?,00000000), ref: 00405834
                                                                                                                                                                                                                    • SetCurrentDirectoryW.KERNELBASE(?,004D3000,?,00000000,000000F0), ref: 0040164D
                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                    • Source File: 00000000.00000002.2527338492.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527299574.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527452560.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.0000000000460000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.0000000000464000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2528550754.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                    • Snapshot File: hcaresult_0_2_400000_cMqyGFCQHk.jbxd
                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                    • API ID: CharNext$Directory$AttributesCreateCurrentFile
                                                                                                                                                                                                                    • String ID:
                                                                                                                                                                                                                    • API String ID: 1892508949-0
                                                                                                                                                                                                                    • Opcode ID: 125bac33416d21a80fc522b842b933099275dd0dd1ea66691da55d5ffdcd1f5d
                                                                                                                                                                                                                    • Instruction ID: 536d45c59d08a7b21130d9dbd5b0e10796a041e4a40079992e14d28e29d42f71
                                                                                                                                                                                                                    • Opcode Fuzzy Hash: 125bac33416d21a80fc522b842b933099275dd0dd1ea66691da55d5ffdcd1f5d
                                                                                                                                                                                                                    • Instruction Fuzzy Hash: 2211E231504505EBCF30AFA1CD0159F36A0EF14369B28493BFA45B22F1DB3E8A919B5E
                                                                                                                                                                                                                    Function 00402484 Relevance: 3.1, APIs: 2, Instructions: 56registryCOMMON
                                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                    • RegQueryValueExW.ADVAPI32(00000000,00000000,?,?,?,?), ref: 004024B5
                                                                                                                                                                                                                    • RegCloseKey.ADVAPI32(?,?,?,C:\Users\user\AppData\Local\Temp\nshFAEA.tmp,00000000,00000011,00000002), ref: 00402557
                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                    • Source File: 00000000.00000002.2527338492.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527299574.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527452560.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.0000000000460000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.0000000000464000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2528550754.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                    • Snapshot File: hcaresult_0_2_400000_cMqyGFCQHk.jbxd
                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                    • API ID: CloseQueryValue
                                                                                                                                                                                                                    • String ID:
                                                                                                                                                                                                                    • API String ID: 3356406503-0
                                                                                                                                                                                                                    • Opcode ID: 8c6ae37f0c00b40db9a7f0b8771259aad396ca2ebfe9c6ecab15c5ec5bd387db
                                                                                                                                                                                                                    • Instruction ID: 1206e07bb255176646816810ef0290bee69920d7ecde6c9ccbb84b14c6b4306b
                                                                                                                                                                                                                    • Opcode Fuzzy Hash: 8c6ae37f0c00b40db9a7f0b8771259aad396ca2ebfe9c6ecab15c5ec5bd387db
                                                                                                                                                                                                                    • Instruction Fuzzy Hash: E311A771D10205EBDF14DFA4CA585AE77B4EF44348B20843FE505B72C0D6B89A41EB5E
                                                                                                                                                                                                                    Function 00401389 Relevance: 3.0, APIs: 2, Instructions: 43windowCOMMON
                                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                    • MulDiv.KERNEL32(00007530,00000000,00000000), ref: 004013E4
                                                                                                                                                                                                                    • SendMessageW.USER32(00000402,00000402,00000000), ref: 004013F4
                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                    • Source File: 00000000.00000002.2527338492.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527299574.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527452560.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.0000000000460000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.0000000000464000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2528550754.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                    • Snapshot File: hcaresult_0_2_400000_cMqyGFCQHk.jbxd
                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                    • API ID: MessageSend
                                                                                                                                                                                                                    • String ID:
                                                                                                                                                                                                                    • API String ID: 3850602802-0
                                                                                                                                                                                                                    • Opcode ID: be076caaca7df3d109edefedbdc7bfa3a965653d784c315eb79774cf5cfe89e5
                                                                                                                                                                                                                    • Instruction ID: ea42f58d7670a619ed9131e80823b54190387dbc53765a55c310ef4228f9fff3
                                                                                                                                                                                                                    • Opcode Fuzzy Hash: be076caaca7df3d109edefedbdc7bfa3a965653d784c315eb79774cf5cfe89e5
                                                                                                                                                                                                                    • Instruction Fuzzy Hash: AF0128316202109BE7095B789E04B2A3798E710315F10463FF855F62F1D6B8CC829B5C
                                                                                                                                                                                                                    Function 004053F5 Relevance: 3.0, APIs: 2, Instructions: 32comCOMMON
                                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                    • OleInitialize.OLE32(00000000), ref: 00405405
                                                                                                                                                                                                                      • Part of subcall function 0040427D: SendMessageW.USER32(?,00000000,00000000,00000000), ref: 0040428F
                                                                                                                                                                                                                    • CoUninitialize.COMBASE(00000404,00000000), ref: 00405451
                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                    • Source File: 00000000.00000002.2527338492.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527299574.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527452560.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.0000000000460000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.0000000000464000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2528550754.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                    • Snapshot File: hcaresult_0_2_400000_cMqyGFCQHk.jbxd
                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                    • API ID: InitializeMessageSendUninitialize
                                                                                                                                                                                                                    • String ID:
                                                                                                                                                                                                                    • API String ID: 2896919175-0
                                                                                                                                                                                                                    • Opcode ID: a1f8c397b5266fa352d60afbf9b4c77fa9abc53c67a054b05b22dcb893a39c3f
                                                                                                                                                                                                                    • Instruction ID: 7813e2a1ccdf537c56c01956b79198a0443dbd649336f33e6835a7e221d2fb99
                                                                                                                                                                                                                    • Opcode Fuzzy Hash: a1f8c397b5266fa352d60afbf9b4c77fa9abc53c67a054b05b22dcb893a39c3f
                                                                                                                                                                                                                    • Instruction Fuzzy Hash: ABF090B25406009BE7015B549D01BAB7760EFD431AF05443EFF89B22E0D77948928E6E
                                                                                                                                                                                                                    Function 00401E49 Relevance: 3.0, APIs: 2, Instructions: 25COMMON
                                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                    • ShowWindow.USER32(00000000,00000000), ref: 00401E67
                                                                                                                                                                                                                    • EnableWindow.USER32(00000000,00000000), ref: 00401E72
                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                    • Source File: 00000000.00000002.2527338492.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527299574.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527452560.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.0000000000460000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.0000000000464000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2528550754.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                    • Snapshot File: hcaresult_0_2_400000_cMqyGFCQHk.jbxd
                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                    • API ID: Window$EnableShow
                                                                                                                                                                                                                    • String ID:
                                                                                                                                                                                                                    • API String ID: 1136574915-0
                                                                                                                                                                                                                    • Opcode ID: 87f8232cb56b7a5d6ce9856bfa50bd061077f9975d19b3a51d23438555d97d86
                                                                                                                                                                                                                    • Instruction ID: fc8c1c2e7d4a5a8f9e35cd12a8e681b154a8316ed36a6d041aa31def844ca7e2
                                                                                                                                                                                                                    • Opcode Fuzzy Hash: 87f8232cb56b7a5d6ce9856bfa50bd061077f9975d19b3a51d23438555d97d86
                                                                                                                                                                                                                    • Instruction Fuzzy Hash: 61E01A72E082008FE724ABA5AA495AD77B4EB90365B20847FE211F11D1DA7858819F6A
                                                                                                                                                                                                                    Function 00406694 Relevance: 3.0, APIs: 2, Instructions: 22libraryloaderCOMMON
                                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                    • GetModuleHandleA.KERNEL32(?,00000020,?,00403401,0000000A), ref: 004066A6
                                                                                                                                                                                                                    • GetProcAddress.KERNEL32(00000000,?), ref: 004066C1
                                                                                                                                                                                                                      • Part of subcall function 00406624: GetSystemDirectoryW.KERNEL32(?,00000104), ref: 0040663B
                                                                                                                                                                                                                      • Part of subcall function 00406624: wsprintfW.USER32 ref: 00406676
                                                                                                                                                                                                                      • Part of subcall function 00406624: LoadLibraryExW.KERNEL32(?,00000000,00000008), ref: 0040668A
                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                    • Source File: 00000000.00000002.2527338492.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527299574.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527452560.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.0000000000460000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.0000000000464000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2528550754.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                    • Snapshot File: hcaresult_0_2_400000_cMqyGFCQHk.jbxd
                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                    • API ID: AddressDirectoryHandleLibraryLoadModuleProcSystemwsprintf
                                                                                                                                                                                                                    • String ID:
                                                                                                                                                                                                                    • API String ID: 2547128583-0
                                                                                                                                                                                                                    • Opcode ID: 2c450699f5e5c6ed5e41876474a170b73f17b01a65d70064c3ee9ca103cb2d45
                                                                                                                                                                                                                    • Instruction ID: 155b38c425e345f43688a0673e138072f65e923c2ca09dacbbabb210d44f0fbf
                                                                                                                                                                                                                    • Opcode Fuzzy Hash: 2c450699f5e5c6ed5e41876474a170b73f17b01a65d70064c3ee9ca103cb2d45
                                                                                                                                                                                                                    • Instruction Fuzzy Hash: 50E0863250461156D31197709E4487762EC9B95750307483EF946F2091DB399C36A66D
                                                                                                                                                                                                                    Function 00403915 Relevance: 3.0, APIs: 2, Instructions: 19COMMON
                                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                    • FreeLibrary.KERNELBASE(?,004DF000,00000000,76233420,004038ED,00403703,00000006,?,00000006,00000008,0000000A), ref: 0040392F
                                                                                                                                                                                                                    • GlobalFree.KERNEL32(?), ref: 00403936
                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                    • Source File: 00000000.00000002.2527338492.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527299574.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527452560.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.0000000000460000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.0000000000464000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2528550754.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                    • Snapshot File: hcaresult_0_2_400000_cMqyGFCQHk.jbxd
                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                    • API ID: Free$GlobalLibrary
                                                                                                                                                                                                                    • String ID:
                                                                                                                                                                                                                    • API String ID: 1100898210-0
                                                                                                                                                                                                                    • Opcode ID: bd7b370b1f223a5589d226506ef49f546026ce3eccc4315b581019b2d362f361
                                                                                                                                                                                                                    • Instruction ID: 228f896298dd83b048f64e6024dd5859bf02c68f9830d759f3998b57695c5827
                                                                                                                                                                                                                    • Opcode Fuzzy Hash: bd7b370b1f223a5589d226506ef49f546026ce3eccc4315b581019b2d362f361
                                                                                                                                                                                                                    • Instruction Fuzzy Hash: 12E0C2334122205BC6215F04ED08B5A776CAF49B32F15407AFA807B2A087B81C928FC8
                                                                                                                                                                                                                    Function 00405DB0 Relevance: 3.0, APIs: 2, Instructions: 16fileCOMMON
                                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                    • GetFileAttributesW.KERNELBASE(004E7000,00402F1D,004E7000,80000000,00000003,?,00000006,00000008,0000000A), ref: 00405DB4
                                                                                                                                                                                                                    • CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000,?,00000006,00000008,0000000A), ref: 00405DD6
                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                    • Source File: 00000000.00000002.2527338492.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527299574.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527452560.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.0000000000460000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.0000000000464000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2528550754.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                    • Snapshot File: hcaresult_0_2_400000_cMqyGFCQHk.jbxd
                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                    • API ID: File$AttributesCreate
                                                                                                                                                                                                                    • String ID:
                                                                                                                                                                                                                    • API String ID: 415043291-0
                                                                                                                                                                                                                    • Opcode ID: e3266cf20b616526e148e4639a7b0fb2c73eec3b674a7d239963b130731368bc
                                                                                                                                                                                                                    • Instruction ID: 684cdbd871a87963be1dc25f749e3f1c2e3aca1a790447dc63e6e481d8426dbe
                                                                                                                                                                                                                    • Opcode Fuzzy Hash: e3266cf20b616526e148e4639a7b0fb2c73eec3b674a7d239963b130731368bc
                                                                                                                                                                                                                    • Instruction Fuzzy Hash: 5DD09E31254301AFEF098F20DE16F2EBBA2EB84B05F11552CB786940E0DA7158199B15
                                                                                                                                                                                                                    Function 00405D8B Relevance: 3.0, APIs: 2, Instructions: 13COMMON
                                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                    • GetFileAttributesW.KERNELBASE(?,?,00405990,?,?,00000000,00405B66,?,?,?,?), ref: 00405D90
                                                                                                                                                                                                                    • SetFileAttributesW.KERNELBASE(?,00000000), ref: 00405DA4
                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                    • Source File: 00000000.00000002.2527338492.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527299574.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527452560.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.0000000000460000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.0000000000464000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2528550754.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                    • Snapshot File: hcaresult_0_2_400000_cMqyGFCQHk.jbxd
                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                    • API ID: AttributesFile
                                                                                                                                                                                                                    • String ID:
                                                                                                                                                                                                                    • API String ID: 3188754299-0
                                                                                                                                                                                                                    • Opcode ID: abb1859115452ae29e15aed1e23886b2a100c548e8c413493f0cbd9ae974b18a
                                                                                                                                                                                                                    • Instruction ID: fe430eedc911e7c92ce83e5abbc00e08444bb0e311ec0623c818608bfa408f6d
                                                                                                                                                                                                                    • Opcode Fuzzy Hash: abb1859115452ae29e15aed1e23886b2a100c548e8c413493f0cbd9ae974b18a
                                                                                                                                                                                                                    • Instruction Fuzzy Hash: 1BD0C972504420ABD2512728AF0C89BBB95DB542717028B39FAA9A22B0CB304C568A98
                                                                                                                                                                                                                    Function 004038D0 Relevance: 3.0, APIs: 1, Strings: 1, Instructions: 11COMMON
                                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                    • CloseHandle.KERNEL32(FFFFFFFF,00403703,00000006,?,00000006,00000008,0000000A), ref: 004038DB
                                                                                                                                                                                                                    Strings
                                                                                                                                                                                                                    • C:\Users\user\AppData\Local\Temp\nshFAEA.tmp\, xrefs: 004038EF
                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                    • Source File: 00000000.00000002.2527338492.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527299574.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527452560.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.0000000000460000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.0000000000464000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2528550754.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                    • Snapshot File: hcaresult_0_2_400000_cMqyGFCQHk.jbxd
                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                    • API ID: CloseHandle
                                                                                                                                                                                                                    • String ID: C:\Users\user\AppData\Local\Temp\nshFAEA.tmp\
                                                                                                                                                                                                                    • API String ID: 2962429428-607566041
                                                                                                                                                                                                                    • Opcode ID: 6cd6e50f5f17456ee504dea1d279a22ffa05636b30f87aa31bf8984a95f31d7c
                                                                                                                                                                                                                    • Instruction ID: f79f1cdd038f729e9031bf35a7c7ad7adb8aafebcc14ea038f42f7e62efb972e
                                                                                                                                                                                                                    • Opcode Fuzzy Hash: 6cd6e50f5f17456ee504dea1d279a22ffa05636b30f87aa31bf8984a95f31d7c
                                                                                                                                                                                                                    • Instruction Fuzzy Hash: 69C0127054070496C1206F759D4F6193E54AB8173BB604776B0B8B10F1C77C4B59595E
                                                                                                                                                                                                                    Function 0040586E Relevance: 3.0, APIs: 2, Instructions: 9COMMON
                                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                    • CreateDirectoryW.KERNELBASE(?,00000000,00403382,004DF000,004DF000,004DF000,004DF000,76233420,004035D9,?,00000006,00000008,0000000A), ref: 00405874
                                                                                                                                                                                                                    • GetLastError.KERNEL32(?,00000006,00000008,0000000A), ref: 00405882
                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                    • Source File: 00000000.00000002.2527338492.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527299574.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527452560.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.0000000000460000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.0000000000464000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2528550754.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                    • Snapshot File: hcaresult_0_2_400000_cMqyGFCQHk.jbxd
                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                    • API ID: CreateDirectoryErrorLast
                                                                                                                                                                                                                    • String ID:
                                                                                                                                                                                                                    • API String ID: 1375471231-0
                                                                                                                                                                                                                    • Opcode ID: 5aaa147db34fee021f71137ce00f1128120fffe197b4e0338bd4cd09c611a0b2
                                                                                                                                                                                                                    • Instruction ID: b5712d1dc6f90c91938fb9970759bfac189bcafefc635788875416fd9ee2894b
                                                                                                                                                                                                                    • Opcode Fuzzy Hash: 5aaa147db34fee021f71137ce00f1128120fffe197b4e0338bd4cd09c611a0b2
                                                                                                                                                                                                                    • Instruction Fuzzy Hash: 2FC04C712155019ED7546F619F08B277A50EB60781F158839A946E10E0DB348465ED2D
                                                                                                                                                                                                                    Function 00406155 Relevance: 1.5, APIs: 1, Instructions: 24registryCOMMON
                                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                    • RegCreateKeyExW.KERNELBASE(00000000,?,00000000,00000000,00000000,?,00000000,?,00000000,?,?,?,00402CF2,00000000,?,?), ref: 0040617E
                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                    • Source File: 00000000.00000002.2527338492.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527299574.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527452560.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.0000000000460000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.0000000000464000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2528550754.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                    • Snapshot File: hcaresult_0_2_400000_cMqyGFCQHk.jbxd
                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                    • API ID: Create
                                                                                                                                                                                                                    • String ID:
                                                                                                                                                                                                                    • API String ID: 2289755597-0
                                                                                                                                                                                                                    • Opcode ID: e8292e86e66d8bfc399a73dea3ede4946860b06fd3b50e0b30bb299c90100862
                                                                                                                                                                                                                    • Instruction ID: dcb86bc894ab99bc20e37dc8a6176b737b641c0fdee4176656c7f25b47436c56
                                                                                                                                                                                                                    • Opcode Fuzzy Hash: e8292e86e66d8bfc399a73dea3ede4946860b06fd3b50e0b30bb299c90100862
                                                                                                                                                                                                                    • Instruction Fuzzy Hash: 75E0E6B2110109BEEF195F50DD0AD7B375DE704304F01452EFA06D4091E6B5AD315634
                                                                                                                                                                                                                    Function 00405E62 Relevance: 1.5, APIs: 1, Instructions: 22fileCOMMON
                                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                    • WriteFile.KERNELBASE(00000000,00000000,00000004,00000004,00000000,?,?,004032FA,000000FF,00428200,?,00428200,?,?,00000004,00000000), ref: 00405E76
                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                    • Source File: 00000000.00000002.2527338492.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527299574.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527452560.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.0000000000460000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.0000000000464000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2528550754.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                    • Snapshot File: hcaresult_0_2_400000_cMqyGFCQHk.jbxd
                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                    • API ID: FileWrite
                                                                                                                                                                                                                    • String ID:
                                                                                                                                                                                                                    • API String ID: 3934441357-0
                                                                                                                                                                                                                    • Opcode ID: 02dc4867d73beddbae7b6aa94ca18310df5187db1130d79069d379e72bcbc858
                                                                                                                                                                                                                    • Instruction ID: 8754e0b6f25d564075f0081c534dd79b85a2df0f0bc88b3642164a4a3ec1e455
                                                                                                                                                                                                                    • Opcode Fuzzy Hash: 02dc4867d73beddbae7b6aa94ca18310df5187db1130d79069d379e72bcbc858
                                                                                                                                                                                                                    • Instruction Fuzzy Hash: FDE0B63221065AAFDF109F95DC00AAB7B6CEB052A0F044437FD59E7150D671EA21DAE4
                                                                                                                                                                                                                    Function 00405E33 Relevance: 1.5, APIs: 1, Instructions: 22fileCOMMON
                                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                    • ReadFile.KERNELBASE(00000000,00000000,00000004,00000004,00000000,?,?,00403344,00000000,00000000,00403168,?,00000004,00000000,00000000,00000000), ref: 00405E47
                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                    • Source File: 00000000.00000002.2527338492.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527299574.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527452560.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.0000000000460000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.0000000000464000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2528550754.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                    • Snapshot File: hcaresult_0_2_400000_cMqyGFCQHk.jbxd
                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                    • API ID: FileRead
                                                                                                                                                                                                                    • String ID:
                                                                                                                                                                                                                    • API String ID: 2738559852-0
                                                                                                                                                                                                                    • Opcode ID: 7739e01b11ed9e02f3c754170f73e593db9a2046c62570b976e55369a775b70d
                                                                                                                                                                                                                    • Instruction ID: bd732019988057c431ec21c3a2c50b1292625b962aa4d7912315599e48db2a91
                                                                                                                                                                                                                    • Opcode Fuzzy Hash: 7739e01b11ed9e02f3c754170f73e593db9a2046c62570b976e55369a775b70d
                                                                                                                                                                                                                    • Instruction Fuzzy Hash: A9E08C3220021AABCF20AF54DC00FEB3B6CEB05760F004832FD65E6040E230EA219BE8
                                                                                                                                                                                                                    Function 00406127 Relevance: 1.5, APIs: 1, Instructions: 19registryCOMMON
                                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                    • RegOpenKeyExW.KERNELBASE(00000000,00000000,00000000,?,?,?,?,?,004061B5,?,00000000,?,?,Remove folder: ,?), ref: 0040614B
                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                    • Source File: 00000000.00000002.2527338492.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527299574.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527452560.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.0000000000460000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.0000000000464000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2528550754.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                    • Snapshot File: hcaresult_0_2_400000_cMqyGFCQHk.jbxd
                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                    • API ID: Open
                                                                                                                                                                                                                    • String ID:
                                                                                                                                                                                                                    • API String ID: 71445658-0
                                                                                                                                                                                                                    • Opcode ID: a8e94fdf895113144ef30ac0413fc9f69bed743b5e5124c6f76e238eb3875bc5
                                                                                                                                                                                                                    • Instruction ID: b908bd292ce434c6339c018d18c1e3bfafdd2f7559b63d477f04a141d62eba1a
                                                                                                                                                                                                                    • Opcode Fuzzy Hash: a8e94fdf895113144ef30ac0413fc9f69bed743b5e5124c6f76e238eb3875bc5
                                                                                                                                                                                                                    • Instruction Fuzzy Hash: 94D0123214020DFBDF119E909D01FAB775DAB08350F014426FE06A9191D776D530AB14
                                                                                                                                                                                                                    Function 00404231 Relevance: 1.5, APIs: 1, Instructions: 10COMMON
                                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                    • SetDlgItemTextW.USER32(?,?,00000000), ref: 0040424B
                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                    • Source File: 00000000.00000002.2527338492.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527299574.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527452560.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.0000000000460000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.0000000000464000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2528550754.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                    • Snapshot File: hcaresult_0_2_400000_cMqyGFCQHk.jbxd
                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                    • API ID: ItemText
                                                                                                                                                                                                                    • String ID:
                                                                                                                                                                                                                    • API String ID: 3367045223-0
                                                                                                                                                                                                                    • Opcode ID: fbaad98f197721c3337b4145f660dfcccd1462cc21775b0cc75c291dee439915
                                                                                                                                                                                                                    • Instruction ID: 58c8b0ee816a9f079cb4560b894257bfb9dfa06490f5d5235509ae25e2c95a64
                                                                                                                                                                                                                    • Opcode Fuzzy Hash: fbaad98f197721c3337b4145f660dfcccd1462cc21775b0cc75c291dee439915
                                                                                                                                                                                                                    • Instruction Fuzzy Hash: 79C04C76148300BFD681BB55CC42F1FB79DEF94315F44C52EB59CA11E2C63A84309B26
                                                                                                                                                                                                                    Function 0040427D Relevance: 1.5, APIs: 1, Instructions: 9windowCOMMON
                                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                    • SendMessageW.USER32(?,00000000,00000000,00000000), ref: 0040428F
                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                    • Source File: 00000000.00000002.2527338492.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527299574.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527452560.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.0000000000460000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.0000000000464000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2528550754.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                    • Snapshot File: hcaresult_0_2_400000_cMqyGFCQHk.jbxd
                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                    • API ID: MessageSend
                                                                                                                                                                                                                    • String ID:
                                                                                                                                                                                                                    • API String ID: 3850602802-0
                                                                                                                                                                                                                    • Opcode ID: df53f0ac968c80b2573d185eedc41732bb4466fa0b660203ffcc6a72f8356a2c
                                                                                                                                                                                                                    • Instruction ID: 539d97cecbd0a6245bb22c05259f77f590d4a0b0d5c0f28d123e3a53dcb21da8
                                                                                                                                                                                                                    • Opcode Fuzzy Hash: df53f0ac968c80b2573d185eedc41732bb4466fa0b660203ffcc6a72f8356a2c
                                                                                                                                                                                                                    • Instruction Fuzzy Hash: C6C09BB27403007BDE11CB909E49F1777545790740F18447DB348F51E0D6B4D490D61C
                                                                                                                                                                                                                    Function 00403347 Relevance: 1.5, APIs: 1, Instructions: 6COMMON
                                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                    • SetFilePointer.KERNELBASE(?,00000000,00000000,004030A4,?,?,00000006,00000008,0000000A), ref: 00403355
                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                    • Source File: 00000000.00000002.2527338492.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527299574.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527452560.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.0000000000460000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.0000000000464000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2528550754.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                    • Snapshot File: hcaresult_0_2_400000_cMqyGFCQHk.jbxd
                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                    • API ID: FilePointer
                                                                                                                                                                                                                    • String ID:
                                                                                                                                                                                                                    • API String ID: 973152223-0
                                                                                                                                                                                                                    • Opcode ID: d5a77a7b91dde00220c09aa0a832f43c90240fc94845358d4caa889c1b96a79f
                                                                                                                                                                                                                    • Instruction ID: c7266a3154837caca095f11e7777f6dda2278cbf6cff4ee7664d3894fc3aa091
                                                                                                                                                                                                                    • Opcode Fuzzy Hash: d5a77a7b91dde00220c09aa0a832f43c90240fc94845358d4caa889c1b96a79f
                                                                                                                                                                                                                    • Instruction Fuzzy Hash: ECB01271240300BFDA214F00DF09F057B21AB90700F10C034B348380F086711035EB0D
                                                                                                                                                                                                                    Function 00404266 Relevance: 1.5, APIs: 1, Instructions: 6windowCOMMON
                                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                    • SendMessageW.USER32(00000028,?,00000001,00404091), ref: 00404274
                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                    • Source File: 00000000.00000002.2527338492.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527299574.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527452560.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.0000000000460000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.0000000000464000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2528550754.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                    • Snapshot File: hcaresult_0_2_400000_cMqyGFCQHk.jbxd
                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                    • API ID: MessageSend
                                                                                                                                                                                                                    • String ID:
                                                                                                                                                                                                                    • API String ID: 3850602802-0
                                                                                                                                                                                                                    • Opcode ID: 916ba585e608d634958797641490031ceb4b368d387894d1e0aab50b7c43ae9e
                                                                                                                                                                                                                    • Instruction ID: 80b1fa8ab317a3fb83bf0bb9afc1fcb2ede285a6b5c9b7890d3d6fe7da01b763
                                                                                                                                                                                                                    • Opcode Fuzzy Hash: 916ba585e608d634958797641490031ceb4b368d387894d1e0aab50b7c43ae9e
                                                                                                                                                                                                                    • Instruction Fuzzy Hash: 69B092361C4600AAEE118B50DE49F497A62E7A4702F008138B244640B0CAB200E0DB09
                                                                                                                                                                                                                    Function 00404253 Relevance: 1.5, APIs: 1, Instructions: 4COMMON
                                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                    • KiUserCallbackDispatcher.NTDLL(?,0040402A), ref: 0040425D
                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                    • Source File: 00000000.00000002.2527338492.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527299574.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527452560.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.0000000000460000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.0000000000464000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2528550754.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                    • Snapshot File: hcaresult_0_2_400000_cMqyGFCQHk.jbxd
                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                    • API ID: CallbackDispatcherUser
                                                                                                                                                                                                                    • String ID:
                                                                                                                                                                                                                    • API String ID: 2492992576-0
                                                                                                                                                                                                                    • Opcode ID: ea082ecd867c03a11dfd78164402b3a9c9d6e2ba96aa803d9d5c73deeff3904d
                                                                                                                                                                                                                    • Instruction ID: 6a6b83ba7992c3eb947fe44f0607646ae594aefa1fc7371f7d6a783f6fb0b7b0
                                                                                                                                                                                                                    • Opcode Fuzzy Hash: ea082ecd867c03a11dfd78164402b3a9c9d6e2ba96aa803d9d5c73deeff3904d
                                                                                                                                                                                                                    • Instruction Fuzzy Hash: 4EA002754445019BCF015B50DF098057A61F7A4701B114479B5555103596314860EB19

                                                                                                                                                                                                                    Non-executed Functions

                                                                                                                                                                                                                    Function 00404C9E Relevance: 63.5, APIs: 33, Strings: 3, Instructions: 481windowmemoryCOMMON
                                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                    • GetDlgItem.USER32(?,000003F9), ref: 00404CB6
                                                                                                                                                                                                                    • GetDlgItem.USER32(?,00000408), ref: 00404CC1
                                                                                                                                                                                                                    • GlobalAlloc.KERNEL32(00000040,?), ref: 00404D0B
                                                                                                                                                                                                                    • LoadBitmapW.USER32(0000006E), ref: 00404D1E
                                                                                                                                                                                                                    • SetWindowLongW.USER32(?,000000FC,00405296), ref: 00404D37
                                                                                                                                                                                                                    • ImageList_Create.COMCTL32(00000010,00000010,00000021,00000006,00000000), ref: 00404D4B
                                                                                                                                                                                                                    • ImageList_AddMasked.COMCTL32(00000000,00000000,00FF00FF), ref: 00404D5D
                                                                                                                                                                                                                    • SendMessageW.USER32(?,00001109,00000002), ref: 00404D73
                                                                                                                                                                                                                    • SendMessageW.USER32(?,0000111C,00000000,00000000), ref: 00404D7F
                                                                                                                                                                                                                    • SendMessageW.USER32(?,0000111B,00000010,00000000), ref: 00404D91
                                                                                                                                                                                                                    • DeleteObject.GDI32(00000000), ref: 00404D94
                                                                                                                                                                                                                    • SendMessageW.USER32(?,00000143,00000000,00000000), ref: 00404DBF
                                                                                                                                                                                                                    • SendMessageW.USER32(?,00000151,00000000,00000000), ref: 00404DCB
                                                                                                                                                                                                                    • SendMessageW.USER32(?,00001132,00000000,?), ref: 00404E61
                                                                                                                                                                                                                    • SendMessageW.USER32(?,0000110A,00000003,00000000), ref: 00404E8C
                                                                                                                                                                                                                    • SendMessageW.USER32(?,00001132,00000000,?), ref: 00404EA0
                                                                                                                                                                                                                    • GetWindowLongW.USER32(?,000000F0), ref: 00404ECF
                                                                                                                                                                                                                    • SetWindowLongW.USER32(?,000000F0,00000000), ref: 00404EDD
                                                                                                                                                                                                                    • ShowWindow.USER32(?,00000005), ref: 00404EEE
                                                                                                                                                                                                                    • SendMessageW.USER32(?,00000419,00000000,?), ref: 00404FEB
                                                                                                                                                                                                                    • SendMessageW.USER32(?,00000147,00000000,00000000), ref: 00405050
                                                                                                                                                                                                                    • SendMessageW.USER32(?,00000150,00000000,00000000), ref: 00405065
                                                                                                                                                                                                                    • SendMessageW.USER32(?,00000420,00000000,00000020), ref: 00405089
                                                                                                                                                                                                                    • SendMessageW.USER32(?,00000200,00000000,00000000), ref: 004050A9
                                                                                                                                                                                                                    • ImageList_Destroy.COMCTL32(?), ref: 004050BE
                                                                                                                                                                                                                    • GlobalFree.KERNEL32(?), ref: 004050CE
                                                                                                                                                                                                                    • SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00405147
                                                                                                                                                                                                                    • SendMessageW.USER32(?,00001102,?,?), ref: 004051F0
                                                                                                                                                                                                                    • SendMessageW.USER32(?,0000113F,00000000,00000008), ref: 004051FF
                                                                                                                                                                                                                    • InvalidateRect.USER32(?,00000000,00000001), ref: 0040521F
                                                                                                                                                                                                                    • ShowWindow.USER32(?,00000000), ref: 0040526D
                                                                                                                                                                                                                    • GetDlgItem.USER32(?,000003FE), ref: 00405278
                                                                                                                                                                                                                    • ShowWindow.USER32(00000000), ref: 0040527F
                                                                                                                                                                                                                    Strings
                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                    • Source File: 00000000.00000002.2527338492.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527299574.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527452560.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.0000000000460000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.0000000000464000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2528550754.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                    • Snapshot File: hcaresult_0_2_400000_cMqyGFCQHk.jbxd
                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                    • API ID: MessageSend$Window$ImageItemList_LongShow$Global$AllocBitmapCreateDeleteDestroyFreeInvalidateLoadMaskedObjectRect
                                                                                                                                                                                                                    • String ID: $M$N
                                                                                                                                                                                                                    • API String ID: 1638840714-813528018
                                                                                                                                                                                                                    • Opcode ID: 21818fa51d6b588aeca07265a4b81a3a3b935111f3ce34767c97606af49217ff
                                                                                                                                                                                                                    • Instruction ID: 350e9793ba1948ff1935c4af006ad7833f39553502bf8ecbcf91bc97059cc7bb
                                                                                                                                                                                                                    • Opcode Fuzzy Hash: 21818fa51d6b588aeca07265a4b81a3a3b935111f3ce34767c97606af49217ff
                                                                                                                                                                                                                    • Instruction Fuzzy Hash: 4C0281B0900209AFDB10DFA4DD85AAE7BB5FB44314F10417AF614BA2E1C7799D92CF58
                                                                                                                                                                                                                    Function 00404722 Relevance: 23.0, APIs: 10, Strings: 3, Instructions: 275stringCOMMON
                                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                    • GetDlgItem.USER32(?,000003FB), ref: 00404771
                                                                                                                                                                                                                    • SetWindowTextW.USER32(00000000,?), ref: 0040479B
                                                                                                                                                                                                                    • SHBrowseForFolderW.SHELL32(?), ref: 0040484C
                                                                                                                                                                                                                    • CoTaskMemFree.OLE32(00000000), ref: 00404857
                                                                                                                                                                                                                    • lstrcmpiW.KERNEL32(Remove folder: ,00450248,00000000,?,?), ref: 00404889
                                                                                                                                                                                                                    • lstrcatW.KERNEL32(?,Remove folder: ), ref: 00404895
                                                                                                                                                                                                                    • SetDlgItemTextW.USER32(?,000003FB,?), ref: 004048A7
                                                                                                                                                                                                                      • Part of subcall function 00405904: GetDlgItemTextW.USER32(?,?,00002000,004048DE), ref: 00405917
                                                                                                                                                                                                                      • Part of subcall function 0040654E: CharNextW.USER32(?,*?|<>/":,00000000,00000000,004DF000,004DF000,004CB000,0040336A,004DF000,76233420,004035D9,?,00000006,00000008,0000000A), ref: 004065B1
                                                                                                                                                                                                                      • Part of subcall function 0040654E: CharNextW.USER32(?,?,?,00000000,?,00000006,00000008,0000000A), ref: 004065C0
                                                                                                                                                                                                                      • Part of subcall function 0040654E: CharNextW.USER32(?,00000000,004DF000,004DF000,004CB000,0040336A,004DF000,76233420,004035D9,?,00000006,00000008,0000000A), ref: 004065C5
                                                                                                                                                                                                                      • Part of subcall function 0040654E: CharPrevW.USER32(?,?,004DF000,004DF000,004CB000,0040336A,004DF000,76233420,004035D9,?,00000006,00000008,0000000A), ref: 004065D8
                                                                                                                                                                                                                    • GetDiskFreeSpaceW.KERNEL32(00440218,?,?,0000040F,?,00440218,00440218,?,00000001,00440218,?,?,000003FB,?), ref: 0040496A
                                                                                                                                                                                                                    • MulDiv.KERNEL32(?,0000040F,00000400), ref: 00404985
                                                                                                                                                                                                                      • Part of subcall function 00404ADE: lstrlenW.KERNEL32(00450248,00450248,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,?,000000DF,00000000,00000400,?), ref: 00404B7F
                                                                                                                                                                                                                      • Part of subcall function 00404ADE: wsprintfW.USER32 ref: 00404B88
                                                                                                                                                                                                                      • Part of subcall function 00404ADE: SetDlgItemTextW.USER32(?,00450248), ref: 00404B9B
                                                                                                                                                                                                                    Strings
                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                    • Source File: 00000000.00000002.2527338492.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527299574.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527452560.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.0000000000460000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.0000000000464000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2528550754.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                    • Snapshot File: hcaresult_0_2_400000_cMqyGFCQHk.jbxd
                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                    • API ID: CharItemText$Next$Free$BrowseDiskFolderPrevSpaceTaskWindowlstrcatlstrcmpilstrlenwsprintf
                                                                                                                                                                                                                    • String ID: A$Remove folder: $|k
                                                                                                                                                                                                                    • API String ID: 2624150263-3956166223
                                                                                                                                                                                                                    • Opcode ID: d9ff5aa2ff53ffbe0c3723e23dc604a8a31f393e15f5d8e1a009d79f52351d08
                                                                                                                                                                                                                    • Instruction ID: aec38ac33e169681c2ce75898e964705c21f391e9d8eef84a8e49708370a7c65
                                                                                                                                                                                                                    • Opcode Fuzzy Hash: d9ff5aa2ff53ffbe0c3723e23dc604a8a31f393e15f5d8e1a009d79f52351d08
                                                                                                                                                                                                                    • Instruction Fuzzy Hash: 0CA173B1900208ABDB11AFA5CD45AAF77B8EF84314F10847BF605B62D1D77C99418F6D
                                                                                                                                                                                                                    Function 00402104 Relevance: 1.6, APIs: 1, Instructions: 129comCOMMON
                                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                    • CoCreateInstance.OLE32(004085F0,?,00000001,004085E0,?,?,00000045,000000CD,00000002,000000DF,000000F0), ref: 00402183
                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                    • Source File: 00000000.00000002.2527338492.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527299574.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527452560.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.0000000000460000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.0000000000464000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2528550754.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                    • Snapshot File: hcaresult_0_2_400000_cMqyGFCQHk.jbxd
                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                    • API ID: CreateInstance
                                                                                                                                                                                                                    • String ID:
                                                                                                                                                                                                                    • API String ID: 542301482-0
                                                                                                                                                                                                                    • Opcode ID: 6add73535d334bbd10faeab47eb29d8a703edf5c42766cfe57afeb0baa1f3480
                                                                                                                                                                                                                    • Instruction ID: 6590b0d0bd135a94e5278e34c2007f8374f9804fe0c2ec815525577e7f77d17f
                                                                                                                                                                                                                    • Opcode Fuzzy Hash: 6add73535d334bbd10faeab47eb29d8a703edf5c42766cfe57afeb0baa1f3480
                                                                                                                                                                                                                    • Instruction Fuzzy Hash: 01414C71A00208AFCF04DFE4C988A9D7BB5FF48314B24457AF915EB2E0DBB99981CB44
                                                                                                                                                                                                                    Function 00402868 Relevance: 1.5, APIs: 1, Instructions: 30fileCOMMON
                                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                    • FindFirstFileW.KERNEL32(00000000,?,00000002), ref: 00402877
                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                    • Source File: 00000000.00000002.2527338492.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527299574.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527452560.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.0000000000460000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.0000000000464000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2528550754.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                    • Snapshot File: hcaresult_0_2_400000_cMqyGFCQHk.jbxd
                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                    • API ID: FileFindFirst
                                                                                                                                                                                                                    • String ID:
                                                                                                                                                                                                                    • API String ID: 1974802433-0
                                                                                                                                                                                                                    • Opcode ID: 54b460b755f9bf27e46ac1d39a8a1124328dc74cebdc85c095498b08f8838b6a
                                                                                                                                                                                                                    • Instruction ID: 11d43fc069a5ea90b0fea77c2c23c6da8a8dfc92bb9fdb714ff4c9b8b345b962
                                                                                                                                                                                                                    • Opcode Fuzzy Hash: 54b460b755f9bf27e46ac1d39a8a1124328dc74cebdc85c095498b08f8838b6a
                                                                                                                                                                                                                    • Instruction Fuzzy Hash: 9BF08271A14104EFDB00EBA4DA499ADB378EF04314F6045BBF515F21D1DBB45D909B2A
                                                                                                                                                                                                                    Function 00406B15 Relevance: .3, Instructions: 334COMMON
                                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                    • Source File: 00000000.00000002.2527338492.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527299574.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527452560.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.0000000000460000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.0000000000464000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2528550754.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                    • Snapshot File: hcaresult_0_2_400000_cMqyGFCQHk.jbxd
                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                    • API ID:
                                                                                                                                                                                                                    • String ID:
                                                                                                                                                                                                                    • API String ID:
                                                                                                                                                                                                                    • Opcode ID: 9639f9c0007cb4c124acbb6985d7f6f1a05031d6bc3fffd11e08744ca1378656
                                                                                                                                                                                                                    • Instruction ID: 703def0becceeecb9d8561ea32c53bcab4b84ebc773a8a1d0b412cad538f794c
                                                                                                                                                                                                                    • Opcode Fuzzy Hash: 9639f9c0007cb4c124acbb6985d7f6f1a05031d6bc3fffd11e08744ca1378656
                                                                                                                                                                                                                    • Instruction Fuzzy Hash: 1EE1797190470ADFDB24CF99C880BAAB7F5FF44305F15852EE497A7291E378AA91CB04
                                                                                                                                                                                                                    Function 004072EC Relevance: .3, Instructions: 300COMMON
                                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                    • Source File: 00000000.00000002.2527338492.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527299574.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527452560.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.0000000000460000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.0000000000464000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2528550754.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                    • Snapshot File: hcaresult_0_2_400000_cMqyGFCQHk.jbxd
                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                    • API ID:
                                                                                                                                                                                                                    • String ID:
                                                                                                                                                                                                                    • API String ID:
                                                                                                                                                                                                                    • Opcode ID: 0e4e8af0329ccb159007ad6c77c0af05cb35f857c46231da8f5d0a1659340364
                                                                                                                                                                                                                    • Instruction ID: 59779062152899835760f0dc2f5c49596223a290c6efd11eddd93cbc7c663e45
                                                                                                                                                                                                                    • Opcode Fuzzy Hash: 0e4e8af0329ccb159007ad6c77c0af05cb35f857c46231da8f5d0a1659340364
                                                                                                                                                                                                                    • Instruction Fuzzy Hash: 0FC15831E04219DBDF18CF68C8905EEBBB2BF88314F25866AC85677380D734A942CF95
                                                                                                                                                                                                                    Function 004043F0 Relevance: 40.5, APIs: 19, Strings: 4, Instructions: 204windowstringCOMMON
                                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                    • CheckDlgButton.USER32(?,-0000040A,00000001), ref: 0040448E
                                                                                                                                                                                                                    • GetDlgItem.USER32(?,000003E8), ref: 004044A2
                                                                                                                                                                                                                    • SendMessageW.USER32(00000000,0000045B,00000001,00000000), ref: 004044BF
                                                                                                                                                                                                                    • GetSysColor.USER32(?), ref: 004044D0
                                                                                                                                                                                                                    • SendMessageW.USER32(00000000,00000443,00000000,?), ref: 004044DE
                                                                                                                                                                                                                    • SendMessageW.USER32(00000000,00000445,00000000,04010000), ref: 004044EC
                                                                                                                                                                                                                    • lstrlenW.KERNEL32(?), ref: 004044F1
                                                                                                                                                                                                                    • SendMessageW.USER32(00000000,00000435,00000000,00000000), ref: 004044FE
                                                                                                                                                                                                                    • SendMessageW.USER32(00000000,00000449,00000110,00000110), ref: 00404513
                                                                                                                                                                                                                    • GetDlgItem.USER32(?,0000040A), ref: 0040456C
                                                                                                                                                                                                                    • SendMessageW.USER32(00000000), ref: 00404573
                                                                                                                                                                                                                    • GetDlgItem.USER32(?,000003E8), ref: 0040459E
                                                                                                                                                                                                                    • SendMessageW.USER32(00000000,0000044B,00000000,00000201), ref: 004045E1
                                                                                                                                                                                                                    • LoadCursorW.USER32(00000000,00007F02), ref: 004045EF
                                                                                                                                                                                                                    • SetCursor.USER32(00000000), ref: 004045F2
                                                                                                                                                                                                                    • LoadCursorW.USER32(00000000,00007F00), ref: 0040460B
                                                                                                                                                                                                                    • SetCursor.USER32(00000000), ref: 0040460E
                                                                                                                                                                                                                    • SendMessageW.USER32(00000111,00000001,00000000), ref: 0040463D
                                                                                                                                                                                                                    • SendMessageW.USER32(00000010,00000000,00000000), ref: 0040464F
                                                                                                                                                                                                                    Strings
                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                    • Source File: 00000000.00000002.2527338492.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527299574.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527452560.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.0000000000460000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.0000000000464000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2528550754.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                    • Snapshot File: hcaresult_0_2_400000_cMqyGFCQHk.jbxd
                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                    • API ID: MessageSend$Cursor$Item$Load$ButtonCheckColorlstrlen
                                                                                                                                                                                                                    • String ID: N$Remove folder: $gC@$|k
                                                                                                                                                                                                                    • API String ID: 3103080414-2285670049
                                                                                                                                                                                                                    • Opcode ID: 96cce4fce431ccadf5917f17b99feddee1f1d895ae547b1ae29d71d99e1dfbb5
                                                                                                                                                                                                                    • Instruction ID: 3402c350d7270d9961c63d8365249516a5ebc70a9ec23ab72cb453283ebd69b0
                                                                                                                                                                                                                    • Opcode Fuzzy Hash: 96cce4fce431ccadf5917f17b99feddee1f1d895ae547b1ae29d71d99e1dfbb5
                                                                                                                                                                                                                    • Instruction Fuzzy Hash: 7761BEB1900209BFDB009F60DD85EAA7B69FB85305F00843AF705B62D0D77D9961CF99
                                                                                                                                                                                                                    Function 00401000 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 125COMMON
                                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                    • DefWindowProcW.USER32(?,00000046,?,?), ref: 0040102C
                                                                                                                                                                                                                    • BeginPaint.USER32(?,?), ref: 00401047
                                                                                                                                                                                                                    • GetClientRect.USER32(?,?), ref: 0040105B
                                                                                                                                                                                                                    • CreateBrushIndirect.GDI32(00000000), ref: 004010CF
                                                                                                                                                                                                                    • FillRect.USER32(00000000,?,00000000), ref: 004010E4
                                                                                                                                                                                                                    • DeleteObject.GDI32(?), ref: 004010ED
                                                                                                                                                                                                                    • CreateFontIndirectW.GDI32(?), ref: 00401105
                                                                                                                                                                                                                    • SetBkMode.GDI32(00000000,00000001), ref: 00401126
                                                                                                                                                                                                                    • SetTextColor.GDI32(00000000,000000FF), ref: 00401130
                                                                                                                                                                                                                    • SelectObject.GDI32(00000000,?), ref: 00401140
                                                                                                                                                                                                                    • DrawTextW.USER32(00000000,00472EE0,000000FF,00000010,00000820), ref: 00401156
                                                                                                                                                                                                                    • SelectObject.GDI32(00000000,00000000), ref: 00401160
                                                                                                                                                                                                                    • DeleteObject.GDI32(?), ref: 00401165
                                                                                                                                                                                                                    • EndPaint.USER32(?,?), ref: 0040116E
                                                                                                                                                                                                                    Strings
                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                    • Source File: 00000000.00000002.2527338492.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527299574.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527452560.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.0000000000460000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.0000000000464000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2528550754.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                    • Snapshot File: hcaresult_0_2_400000_cMqyGFCQHk.jbxd
                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                    • API ID: Object$CreateDeleteIndirectPaintRectSelectText$BeginBrushClientColorDrawFillFontModeProcWindow
                                                                                                                                                                                                                    • String ID: F
                                                                                                                                                                                                                    • API String ID: 941294808-1304234792
                                                                                                                                                                                                                    • Opcode ID: bf214f377d6857cb708af565e6f61848071267d92be3f24c40ffd1659e9a65ef
                                                                                                                                                                                                                    • Instruction ID: 4eb8147a30471c2b969484520d7d1b1c24976f3a1718a772f7b725b3b94c1b26
                                                                                                                                                                                                                    • Opcode Fuzzy Hash: bf214f377d6857cb708af565e6f61848071267d92be3f24c40ffd1659e9a65ef
                                                                                                                                                                                                                    • Instruction Fuzzy Hash: 5C418A71800249AFCF058FA5DE459AF7BB9FF44314F00842AF991AA1A0C778D954DFA4
                                                                                                                                                                                                                    Function 00405F06 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 130memorystringCOMMON
                                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                    • CloseHandle.KERNEL32(00000000,?,00000000,00000001,?,00000000,?,?,004060A1,?,?), ref: 00405F41
                                                                                                                                                                                                                    • GetShortPathNameW.KERNEL32(?,004688E8,00000400), ref: 00405F4A
                                                                                                                                                                                                                      • Part of subcall function 00405D15: lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00405FFA,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405D25
                                                                                                                                                                                                                      • Part of subcall function 00405D15: lstrlenA.KERNEL32(00000000,?,00000000,00405FFA,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405D57
                                                                                                                                                                                                                    • GetShortPathNameW.KERNEL32(?,004690E8,00000400), ref: 00405F67
                                                                                                                                                                                                                    • wsprintfA.USER32 ref: 00405F85
                                                                                                                                                                                                                    • GetFileSize.KERNEL32(00000000,00000000,004690E8,C0000000,00000004,004690E8,?,?,?,?,?), ref: 00405FC0
                                                                                                                                                                                                                    • GlobalAlloc.KERNEL32(00000040,0000000A,?,?,?,?), ref: 00405FCF
                                                                                                                                                                                                                    • lstrcpyA.KERNEL32(00000000,[Rename],00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00406007
                                                                                                                                                                                                                    • SetFilePointer.KERNEL32(0040A560,00000000,00000000,00000000,00000000,004684E8,00000000,-0000000A,0040A560,00000000,[Rename],00000000,00000000,00000000), ref: 0040605D
                                                                                                                                                                                                                    • GlobalFree.KERNEL32(00000000), ref: 0040606E
                                                                                                                                                                                                                    • CloseHandle.KERNEL32(00000000,?,?,?,?), ref: 00406075
                                                                                                                                                                                                                      • Part of subcall function 00405DB0: GetFileAttributesW.KERNELBASE(004E7000,00402F1D,004E7000,80000000,00000003,?,00000006,00000008,0000000A), ref: 00405DB4
                                                                                                                                                                                                                      • Part of subcall function 00405DB0: CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000,?,00000006,00000008,0000000A), ref: 00405DD6
                                                                                                                                                                                                                    Strings
                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                    • Source File: 00000000.00000002.2527338492.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527299574.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527452560.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.0000000000460000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.0000000000464000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2528550754.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                    • Snapshot File: hcaresult_0_2_400000_cMqyGFCQHk.jbxd
                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                    • API ID: File$CloseGlobalHandleNamePathShortlstrlen$AllocAttributesCreateFreePointerSizelstrcpywsprintf
                                                                                                                                                                                                                    • String ID: %ls=%ls$[Rename]
                                                                                                                                                                                                                    • API String ID: 2171350718-461813615
                                                                                                                                                                                                                    • Opcode ID: b694a888aaf83b7fce4c3b5560ec35c5a1d29ec5cfaa1e3dee45fb0367e4abd5
                                                                                                                                                                                                                    • Instruction ID: 1ccef14564d3a4e3590f6d96bf23d62cdd24cd7414a0bd79904b9c13782922cd
                                                                                                                                                                                                                    • Opcode Fuzzy Hash: b694a888aaf83b7fce4c3b5560ec35c5a1d29ec5cfaa1e3dee45fb0367e4abd5
                                                                                                                                                                                                                    • Instruction Fuzzy Hash: 08312530641B05BBC220AB659D48F6B3AACDF45744F15003FFA42F72C2EB7C98118AAD
                                                                                                                                                                                                                    Function 00405322 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 72stringwindowCOMMON
                                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                    • lstrlenW.KERNEL32(Remove folder: C:\Users\user\AppData\Local\Temp\nshFAEA.tmp\,00000000,0042E100,762323A0,?,?,?,?,?,?,?,?,?,0040327A,00000000,?), ref: 0040535A
                                                                                                                                                                                                                    • lstrlenW.KERNEL32(0040327A,Remove folder: C:\Users\user\AppData\Local\Temp\nshFAEA.tmp\,00000000,0042E100,762323A0,?,?,?,?,?,?,?,?,?,0040327A,00000000), ref: 0040536A
                                                                                                                                                                                                                    • lstrcatW.KERNEL32(Remove folder: C:\Users\user\AppData\Local\Temp\nshFAEA.tmp\,0040327A,0040327A,Remove folder: C:\Users\user\AppData\Local\Temp\nshFAEA.tmp\,00000000,0042E100,762323A0), ref: 0040537D
                                                                                                                                                                                                                    • SetWindowTextW.USER32(Remove folder: C:\Users\user\AppData\Local\Temp\nshFAEA.tmp\,Remove folder: C:\Users\user\AppData\Local\Temp\nshFAEA.tmp\), ref: 0040538F
                                                                                                                                                                                                                    • SendMessageW.USER32(?,00001004,00000000,00000000), ref: 004053B5
                                                                                                                                                                                                                    • SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 004053CF
                                                                                                                                                                                                                    • SendMessageW.USER32(?,00001013,?,00000000), ref: 004053DD
                                                                                                                                                                                                                    Strings
                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                    • Source File: 00000000.00000002.2527338492.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527299574.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527452560.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.0000000000460000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.0000000000464000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2528550754.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                    • Snapshot File: hcaresult_0_2_400000_cMqyGFCQHk.jbxd
                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                    • API ID: MessageSend$lstrlen$TextWindowlstrcat
                                                                                                                                                                                                                    • String ID: Remove folder: C:\Users\user\AppData\Local\Temp\nshFAEA.tmp\
                                                                                                                                                                                                                    • API String ID: 2531174081-4159806302
                                                                                                                                                                                                                    • Opcode ID: 03d69ce82fc4e5908464ead601bb3ac1f64f2a51dd32175340e58c4215b781fb
                                                                                                                                                                                                                    • Instruction ID: c4a8b4fbc7344707c8dcd13f789004ac01d88f238d1262f53b2d1dabcf784db2
                                                                                                                                                                                                                    • Opcode Fuzzy Hash: 03d69ce82fc4e5908464ead601bb3ac1f64f2a51dd32175340e58c4215b781fb
                                                                                                                                                                                                                    • Instruction Fuzzy Hash: 1F21A171900518BBCB11AFA5DD849CFBFB9EF45350F10807AF904B62A0C7B94A80DFA8
                                                                                                                                                                                                                    Function 00404298 Relevance: 12.1, APIs: 8, Instructions: 68COMMON
                                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                    • GetWindowLongW.USER32(?,000000EB), ref: 004042B5
                                                                                                                                                                                                                    • GetSysColor.USER32(00000000), ref: 004042F3
                                                                                                                                                                                                                    • SetTextColor.GDI32(?,00000000), ref: 004042FF
                                                                                                                                                                                                                    • SetBkMode.GDI32(?,?), ref: 0040430B
                                                                                                                                                                                                                    • GetSysColor.USER32(?), ref: 0040431E
                                                                                                                                                                                                                    • SetBkColor.GDI32(?,?), ref: 0040432E
                                                                                                                                                                                                                    • DeleteObject.GDI32(?), ref: 00404348
                                                                                                                                                                                                                    • CreateBrushIndirect.GDI32(?), ref: 00404352
                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                    • Source File: 00000000.00000002.2527338492.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527299574.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527452560.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.0000000000460000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.0000000000464000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2528550754.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                    • Snapshot File: hcaresult_0_2_400000_cMqyGFCQHk.jbxd
                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                    • API ID: Color$BrushCreateDeleteIndirectLongModeObjectTextWindow
                                                                                                                                                                                                                    • String ID:
                                                                                                                                                                                                                    • API String ID: 2320649405-0
                                                                                                                                                                                                                    • Opcode ID: cedac81959eb3ef19a74f908d68e4e703a61b794166ebd5b231b869c6a402091
                                                                                                                                                                                                                    • Instruction ID: a3c6a1d12b74a4a342abaca89036a15a37f51972f1e3113ed1cbee018e9c0b42
                                                                                                                                                                                                                    • Opcode Fuzzy Hash: cedac81959eb3ef19a74f908d68e4e703a61b794166ebd5b231b869c6a402091
                                                                                                                                                                                                                    • Instruction Fuzzy Hash: 772156716007059BC724DF78D948B5B77F4AF81710B04893DED96A26E0D734E544CB54
                                                                                                                                                                                                                    Function 0040264A Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 153fileCOMMON
                                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                    • ReadFile.KERNEL32(?,?,?,?), ref: 004026B6
                                                                                                                                                                                                                    • MultiByteToWideChar.KERNEL32(?,00000008,?,?,?,00000001), ref: 004026F1
                                                                                                                                                                                                                    • SetFilePointer.KERNEL32(?,?,?,00000001,?,00000008,?,?,?,00000001), ref: 00402714
                                                                                                                                                                                                                    • MultiByteToWideChar.KERNEL32(?,00000008,?,00000000,?,00000001,?,00000001,?,00000008,?,?,?,00000001), ref: 0040272A
                                                                                                                                                                                                                      • Part of subcall function 00405E91: SetFilePointer.KERNEL32(?,00000000,00000000,00000001), ref: 00405EA7
                                                                                                                                                                                                                    • SetFilePointer.KERNEL32(?,?,?,00000001,?,?,00000002), ref: 004027D6
                                                                                                                                                                                                                    Strings
                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                    • Source File: 00000000.00000002.2527338492.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527299574.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527452560.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.0000000000460000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.0000000000464000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2528550754.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                    • Snapshot File: hcaresult_0_2_400000_cMqyGFCQHk.jbxd
                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                    • API ID: File$Pointer$ByteCharMultiWide$Read
                                                                                                                                                                                                                    • String ID: 9
                                                                                                                                                                                                                    • API String ID: 163830602-2366072709
                                                                                                                                                                                                                    • Opcode ID: 14dc679b194e2ee8669cd1598f353bf1a997ac59cdf020ac1a3b5a5ea93b2031
                                                                                                                                                                                                                    • Instruction ID: 75c70889326ed48cf653b65eedce39ba48716a77e36bbd16e72a3e0392bfe49c
                                                                                                                                                                                                                    • Opcode Fuzzy Hash: 14dc679b194e2ee8669cd1598f353bf1a997ac59cdf020ac1a3b5a5ea93b2031
                                                                                                                                                                                                                    • Instruction Fuzzy Hash: 9C511975D00219AEDF219F95DA88AAEB779FF04304F10443BE901B72D0DBB89982CB58
                                                                                                                                                                                                                    Function 00404BEC Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48windowCOMMON
                                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                    • SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00404C07
                                                                                                                                                                                                                    • GetMessagePos.USER32 ref: 00404C0F
                                                                                                                                                                                                                    • ScreenToClient.USER32(?,?), ref: 00404C29
                                                                                                                                                                                                                    • SendMessageW.USER32(?,00001111,00000000,?), ref: 00404C3B
                                                                                                                                                                                                                    • SendMessageW.USER32(?,0000113E,00000000,?), ref: 00404C61
                                                                                                                                                                                                                    Strings
                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                    • Source File: 00000000.00000002.2527338492.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527299574.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527452560.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.0000000000460000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.0000000000464000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2528550754.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                    • Snapshot File: hcaresult_0_2_400000_cMqyGFCQHk.jbxd
                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                    • API ID: Message$Send$ClientScreen
                                                                                                                                                                                                                    • String ID: f
                                                                                                                                                                                                                    • API String ID: 41195575-1993550816
                                                                                                                                                                                                                    • Opcode ID: e2d2d6aa42d138b4bf43a857dc2fb8cfa63f2fbdf5f441295addbf44c9bf4daa
                                                                                                                                                                                                                    • Instruction ID: 457ccdd811883e010b73e4973708530e0d9e00004b69c5e73a61d7a3cd07de8f
                                                                                                                                                                                                                    • Opcode Fuzzy Hash: e2d2d6aa42d138b4bf43a857dc2fb8cfa63f2fbdf5f441295addbf44c9bf4daa
                                                                                                                                                                                                                    • Instruction Fuzzy Hash: CF015271900218BAEB10DBA4DD85BFEBBBCAF95711F10412BBA50B71D0D7B499018BA4
                                                                                                                                                                                                                    Function 00401DB9 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 43COMMON
                                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                    • GetDC.USER32(?), ref: 00401DBC
                                                                                                                                                                                                                    • GetDeviceCaps.GDI32(00000000,0000005A), ref: 00401DD6
                                                                                                                                                                                                                    • MulDiv.KERNEL32(00000000,00000000), ref: 00401DDE
                                                                                                                                                                                                                    • ReleaseDC.USER32(?,00000000), ref: 00401DEF
                                                                                                                                                                                                                    • CreateFontIndirectW.GDI32(0041E5D0), ref: 00401E3E
                                                                                                                                                                                                                    Strings
                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                    • Source File: 00000000.00000002.2527338492.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527299574.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527452560.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.0000000000460000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.0000000000464000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2528550754.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                    • Snapshot File: hcaresult_0_2_400000_cMqyGFCQHk.jbxd
                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                    • API ID: CapsCreateDeviceFontIndirectRelease
                                                                                                                                                                                                                    • String ID: MS Shell Dlg
                                                                                                                                                                                                                    • API String ID: 3808545654-76309092
                                                                                                                                                                                                                    • Opcode ID: 0e1e500c30e805fc948415589c08143fac03f34b0e69f739ebe91b2620e6c296
                                                                                                                                                                                                                    • Instruction ID: 2f87ef527a079fcd98b3174ff93e15f92fad6858fb92d4176ae60913c966d855
                                                                                                                                                                                                                    • Opcode Fuzzy Hash: 0e1e500c30e805fc948415589c08143fac03f34b0e69f739ebe91b2620e6c296
                                                                                                                                                                                                                    • Instruction Fuzzy Hash: 1A01B575604240BFE700ABF1AE0ABDD7FB5AB55309F10887DF641B61E2DA7840458B2D
                                                                                                                                                                                                                    Function 00402DF3 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 40timeCOMMON
                                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                    • SetTimer.USER32(?,00000001,000000FA,00000000), ref: 00402E11
                                                                                                                                                                                                                    • MulDiv.KERNEL32(052C5A22,00000064,052C6C50), ref: 00402E3C
                                                                                                                                                                                                                    • wsprintfW.USER32 ref: 00402E4C
                                                                                                                                                                                                                    • SetWindowTextW.USER32(?,?), ref: 00402E5C
                                                                                                                                                                                                                    • SetDlgItemTextW.USER32(?,00000406,?), ref: 00402E6E
                                                                                                                                                                                                                    Strings
                                                                                                                                                                                                                    • verifying installer: %d%%, xrefs: 00402E46
                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                    • Source File: 00000000.00000002.2527338492.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527299574.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527452560.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.0000000000460000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.0000000000464000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2528550754.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                    • Snapshot File: hcaresult_0_2_400000_cMqyGFCQHk.jbxd
                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                    • API ID: Text$ItemTimerWindowwsprintf
                                                                                                                                                                                                                    • String ID: verifying installer: %d%%
                                                                                                                                                                                                                    • API String ID: 1451636040-82062127
                                                                                                                                                                                                                    • Opcode ID: 087799c81dd47644162d60d698aafe3a885b0c6ac9c219555e2ca42e9c1670eb
                                                                                                                                                                                                                    • Instruction ID: dfd142ddc65d39fdaa73b229a9921dc7c235b7e072e3123d651e00bd55f03bcf
                                                                                                                                                                                                                    • Opcode Fuzzy Hash: 087799c81dd47644162d60d698aafe3a885b0c6ac9c219555e2ca42e9c1670eb
                                                                                                                                                                                                                    • Instruction Fuzzy Hash: 60014F7164020CABEF209F60DE49FAE3B69AB44304F008439FA06B51E0DBB895558B98
                                                                                                                                                                                                                    Function 004028AD Relevance: 9.1, APIs: 6, Instructions: 86memoryfileCOMMON
                                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                    • GlobalAlloc.KERNEL32(00000040,?,00000000,40000000,00000002,00000000,00000000), ref: 00402901
                                                                                                                                                                                                                    • GlobalAlloc.KERNEL32(00000040,?,00000000,?), ref: 0040291D
                                                                                                                                                                                                                    • GlobalFree.KERNEL32(?), ref: 00402956
                                                                                                                                                                                                                    • GlobalFree.KERNEL32(00000000), ref: 00402969
                                                                                                                                                                                                                    • CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,000000F0), ref: 00402981
                                                                                                                                                                                                                    • DeleteFileW.KERNEL32(?,00000000,40000000,00000002,00000000,00000000), ref: 00402995
                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                    • Source File: 00000000.00000002.2527338492.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527299574.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527452560.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.0000000000460000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.0000000000464000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2528550754.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                    • Snapshot File: hcaresult_0_2_400000_cMqyGFCQHk.jbxd
                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                    • API ID: Global$AllocFree$CloseDeleteFileHandle
                                                                                                                                                                                                                    • String ID:
                                                                                                                                                                                                                    • API String ID: 2667972263-0
                                                                                                                                                                                                                    • Opcode ID: 119b9e301f9c75836b9179208c0dbdb6f02c12704b392f46658d181c58c9b0fc
                                                                                                                                                                                                                    • Instruction ID: 85d8fb478e53a7d33050a02afe9876517184a336e4e72b82bbd0c3cba42884f9
                                                                                                                                                                                                                    • Opcode Fuzzy Hash: 119b9e301f9c75836b9179208c0dbdb6f02c12704b392f46658d181c58c9b0fc
                                                                                                                                                                                                                    • Instruction Fuzzy Hash: D121AEB1800128BBDF116FA5DE89DDE7E79EF08364F14423AF960762E0CB794C418B98
                                                                                                                                                                                                                    Function 0040654E Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 69COMMON
                                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                    • CharNextW.USER32(?,*?|<>/":,00000000,00000000,004DF000,004DF000,004CB000,0040336A,004DF000,76233420,004035D9,?,00000006,00000008,0000000A), ref: 004065B1
                                                                                                                                                                                                                    • CharNextW.USER32(?,?,?,00000000,?,00000006,00000008,0000000A), ref: 004065C0
                                                                                                                                                                                                                    • CharNextW.USER32(?,00000000,004DF000,004DF000,004CB000,0040336A,004DF000,76233420,004035D9,?,00000006,00000008,0000000A), ref: 004065C5
                                                                                                                                                                                                                    • CharPrevW.USER32(?,?,004DF000,004DF000,004CB000,0040336A,004DF000,76233420,004035D9,?,00000006,00000008,0000000A), ref: 004065D8
                                                                                                                                                                                                                    Strings
                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                    • Source File: 00000000.00000002.2527338492.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527299574.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527452560.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.0000000000460000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.0000000000464000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2528550754.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                    • Snapshot File: hcaresult_0_2_400000_cMqyGFCQHk.jbxd
                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                    • API ID: Char$Next$Prev
                                                                                                                                                                                                                    • String ID: *?|<>/":
                                                                                                                                                                                                                    • API String ID: 589700163-165019052
                                                                                                                                                                                                                    • Opcode ID: f2dbc7d310367101a7bf5127f564121aa95c210a65fb008c6410ea5a4ac792ac
                                                                                                                                                                                                                    • Instruction ID: 36fae6fd7d65e337959ab81909abbfc549fe516cf0b4c9ff473ab524d2c4c229
                                                                                                                                                                                                                    • Opcode Fuzzy Hash: f2dbc7d310367101a7bf5127f564121aa95c210a65fb008c6410ea5a4ac792ac
                                                                                                                                                                                                                    • Instruction Fuzzy Hash: B611B65580061279DB302B14BC40EB762F8EF54764F56403FED86732C8EBBC5C9292AD
                                                                                                                                                                                                                    Function 00402598 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 69stringCOMMON
                                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                    • WideCharToMultiByte.KERNEL32(?,?,C:\Users\user\AppData\Local\Temp\nshFAEA.tmp,000000FF,C:\Users\user\AppData\Local\Temp\nshFAEA.tmp\StdUtils.dll,00002000,?,?,00000021), ref: 004025E8
                                                                                                                                                                                                                    • lstrlenA.KERNEL32(C:\Users\user\AppData\Local\Temp\nshFAEA.tmp\StdUtils.dll,?,?,C:\Users\user\AppData\Local\Temp\nshFAEA.tmp,000000FF,C:\Users\user\AppData\Local\Temp\nshFAEA.tmp\StdUtils.dll,00002000,?,?,00000021), ref: 004025F3
                                                                                                                                                                                                                    Strings
                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                    • Source File: 00000000.00000002.2527338492.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527299574.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527452560.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.0000000000460000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.0000000000464000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2528550754.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                    • Snapshot File: hcaresult_0_2_400000_cMqyGFCQHk.jbxd
                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                    • API ID: ByteCharMultiWidelstrlen
                                                                                                                                                                                                                    • String ID: C:\Users\user\AppData\Local\Temp\nshFAEA.tmp$C:\Users\user\AppData\Local\Temp\nshFAEA.tmp\StdUtils.dll
                                                                                                                                                                                                                    • API String ID: 3109718747-560776653
                                                                                                                                                                                                                    • Opcode ID: 991fae946bdf019a7c315e2a20c045ecd4589044c4e58f1009f440a7fe048d5b
                                                                                                                                                                                                                    • Instruction ID: b23dc685b5da5394ac89c8ab13f2cbf985e24fd8d9932a4f5164fd221fdd45c5
                                                                                                                                                                                                                    • Opcode Fuzzy Hash: 991fae946bdf019a7c315e2a20c045ecd4589044c4e58f1009f440a7fe048d5b
                                                                                                                                                                                                                    • Instruction Fuzzy Hash: 76110B72A04201BADB146FF18E89A9F76659F44398F204C3FF102F61D1EAFC89415B5D
                                                                                                                                                                                                                    Function 00401D5D Relevance: 7.5, APIs: 5, Instructions: 39windowCOMMON
                                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                    • GetDlgItem.USER32(?,?), ref: 00401D63
                                                                                                                                                                                                                    • GetClientRect.USER32(00000000,?), ref: 00401D70
                                                                                                                                                                                                                    • LoadImageW.USER32(?,00000000,?,?,?,?), ref: 00401D91
                                                                                                                                                                                                                    • SendMessageW.USER32(00000000,00000172,?,00000000), ref: 00401D9F
                                                                                                                                                                                                                    • DeleteObject.GDI32(00000000), ref: 00401DAE
                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                    • Source File: 00000000.00000002.2527338492.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527299574.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527452560.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.0000000000460000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.0000000000464000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2528550754.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                    • Snapshot File: hcaresult_0_2_400000_cMqyGFCQHk.jbxd
                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                    • API ID: ClientDeleteImageItemLoadMessageObjectRectSend
                                                                                                                                                                                                                    • String ID:
                                                                                                                                                                                                                    • API String ID: 1849352358-0
                                                                                                                                                                                                                    • Opcode ID: aa13740a01abf0a12383255fbb6bacfc07128faef757ca7dce2eb0223a04ec7c
                                                                                                                                                                                                                    • Instruction ID: d9fd13ec482603559a9c09f77eb5ae76b99fbdc016b4c624d38ebcad95bf5f4c
                                                                                                                                                                                                                    • Opcode Fuzzy Hash: aa13740a01abf0a12383255fbb6bacfc07128faef757ca7dce2eb0223a04ec7c
                                                                                                                                                                                                                    • Instruction Fuzzy Hash: 28F0FF72A04518AFDB01DBE4DF88CEEB7BCEB48341B14047AF641F61A0CA749D519B78
                                                                                                                                                                                                                    Function 00404ADE Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84stringCOMMON
                                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                    • lstrlenW.KERNEL32(00450248,00450248,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,?,000000DF,00000000,00000400,?), ref: 00404B7F
                                                                                                                                                                                                                    • wsprintfW.USER32 ref: 00404B88
                                                                                                                                                                                                                    • SetDlgItemTextW.USER32(?,00450248), ref: 00404B9B
                                                                                                                                                                                                                    Strings
                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                    • Source File: 00000000.00000002.2527338492.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527299574.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527452560.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.0000000000460000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.0000000000464000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2528550754.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                    • Snapshot File: hcaresult_0_2_400000_cMqyGFCQHk.jbxd
                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                    • API ID: ItemTextlstrlenwsprintf
                                                                                                                                                                                                                    • String ID: %u.%u%s%s
                                                                                                                                                                                                                    • API String ID: 3540041739-3551169577
                                                                                                                                                                                                                    • Opcode ID: c75ab1504dd8104253bdc04bf71218fd338cad173e8ef5afb4fab122f1cee964
                                                                                                                                                                                                                    • Instruction ID: 65d6ef813479b3ccfd969ec0db039784a4d8c6b5967a53089d3579ec78c560c8
                                                                                                                                                                                                                    • Opcode Fuzzy Hash: c75ab1504dd8104253bdc04bf71218fd338cad173e8ef5afb4fab122f1cee964
                                                                                                                                                                                                                    • Instruction Fuzzy Hash: 401193736041282ADB00656D9C45F9E369C9B85334F25423BFA65F21D1E979D82582E8
                                                                                                                                                                                                                    Function 00405C3A Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 42COMMON
                                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                    • CharNextW.USER32(?,?,C:\,?,00405CAE,C:\,C:\,004DF000,?,76233420,004059EC,?,004DF000,76233420,00000000), ref: 00405C48
                                                                                                                                                                                                                    • CharNextW.USER32(00000000), ref: 00405C4D
                                                                                                                                                                                                                    • CharNextW.USER32(00000000), ref: 00405C65
                                                                                                                                                                                                                    Strings
                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                    • Source File: 00000000.00000002.2527338492.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527299574.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527452560.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.0000000000460000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.0000000000464000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2528550754.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                    • Snapshot File: hcaresult_0_2_400000_cMqyGFCQHk.jbxd
                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                    • API ID: CharNext
                                                                                                                                                                                                                    • String ID: C:\
                                                                                                                                                                                                                    • API String ID: 3213498283-3404278061
                                                                                                                                                                                                                    • Opcode ID: 92222cf075acf2fbc044c76267536a24963eff6ee4d7f8d65295f56b9dd724d0
                                                                                                                                                                                                                    • Instruction ID: 75375947fb2108fa8988f35f37760ff259c71c6e50658764317197b9124938a5
                                                                                                                                                                                                                    • Opcode Fuzzy Hash: 92222cf075acf2fbc044c76267536a24963eff6ee4d7f8d65295f56b9dd724d0
                                                                                                                                                                                                                    • Instruction Fuzzy Hash: DAF0BB61908F1199FB3177644C49E7B66BCDB55350B04853FD641B71C0D7F84C818BD9
                                                                                                                                                                                                                    Function 00402D44 Relevance: 6.1, APIs: 4, Instructions: 63registryCOMMON
                                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                    • RegEnumKeyW.ADVAPI32(?,00000000,?,00000105), ref: 00402DA9
                                                                                                                                                                                                                    • RegCloseKey.ADVAPI32(?,?,?), ref: 00402DB2
                                                                                                                                                                                                                    • RegCloseKey.ADVAPI32(?,?,?), ref: 00402DD3
                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                    • Source File: 00000000.00000002.2527338492.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527299574.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527452560.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.0000000000460000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.0000000000464000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2528550754.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                    • Snapshot File: hcaresult_0_2_400000_cMqyGFCQHk.jbxd
                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                    • API ID: Close$Enum
                                                                                                                                                                                                                    • String ID:
                                                                                                                                                                                                                    • API String ID: 464197530-0
                                                                                                                                                                                                                    • Opcode ID: 783bf1924eaceae6677feedcc5031a151434ee63f91e097ea153fa5b1c868383
                                                                                                                                                                                                                    • Instruction ID: fc7ade2e12cd9e993d25f9a328d8db16c9603ee1eb20de8c24b8f84b94a82c23
                                                                                                                                                                                                                    • Opcode Fuzzy Hash: 783bf1924eaceae6677feedcc5031a151434ee63f91e097ea153fa5b1c868383
                                                                                                                                                                                                                    • Instruction Fuzzy Hash: B4116A32500109FBDF02AB90CE09FEE7B7DAF54340F100076B904B51E1E7B59E21AB68
                                                                                                                                                                                                                    Function 00402E79 Relevance: 6.0, APIs: 4, Instructions: 33COMMON
                                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                    • DestroyWindow.USER32(00000000,00000000,00403059,00000001,?,00000006,00000008,0000000A), ref: 00402E8C
                                                                                                                                                                                                                    • GetTickCount.KERNEL32 ref: 00402EAA
                                                                                                                                                                                                                    • CreateDialogParamW.USER32(0000006F,00000000,00402DF3,00000000), ref: 00402EC7
                                                                                                                                                                                                                    • ShowWindow.USER32(00000000,00000005,?,00000006,00000008,0000000A), ref: 00402ED5
                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                    • Source File: 00000000.00000002.2527338492.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527299574.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527452560.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.0000000000460000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.0000000000464000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2528550754.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                    • Snapshot File: hcaresult_0_2_400000_cMqyGFCQHk.jbxd
                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                    • API ID: Window$CountCreateDestroyDialogParamShowTick
                                                                                                                                                                                                                    • String ID:
                                                                                                                                                                                                                    • API String ID: 2102729457-0
                                                                                                                                                                                                                    • Opcode ID: 924f9f108daf828ee83ef716cb3535c52cefc1d4ff45c1c6af266e6598bfdb86
                                                                                                                                                                                                                    • Instruction ID: 9c0cd9c85579b1f1539786df4f617efd254904ce91a486f6a135d178cfad0ab8
                                                                                                                                                                                                                    • Opcode Fuzzy Hash: 924f9f108daf828ee83ef716cb3535c52cefc1d4ff45c1c6af266e6598bfdb86
                                                                                                                                                                                                                    • Instruction Fuzzy Hash: 7AF05E30485630EBD6506B20FE0CACB7BA5FB84B41B0149BAF005B11E4D7B85880CBDC
                                                                                                                                                                                                                    Function 00405296 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46windowCOMMON
                                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                    • IsWindowVisible.USER32(?), ref: 004052C5
                                                                                                                                                                                                                    • CallWindowProcW.USER32(?,?,?,?), ref: 00405316
                                                                                                                                                                                                                      • Part of subcall function 0040427D: SendMessageW.USER32(?,00000000,00000000,00000000), ref: 0040428F
                                                                                                                                                                                                                    Strings
                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                    • Source File: 00000000.00000002.2527338492.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527299574.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527452560.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.0000000000460000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.0000000000464000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2528550754.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                    • Snapshot File: hcaresult_0_2_400000_cMqyGFCQHk.jbxd
                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                    • API ID: Window$CallMessageProcSendVisible
                                                                                                                                                                                                                    • String ID:
                                                                                                                                                                                                                    • API String ID: 3748168415-3916222277
                                                                                                                                                                                                                    • Opcode ID: 7d5e46cc1e5f02d88c983cfba86e53e431cbed6f21b5100807b47a566b29449e
                                                                                                                                                                                                                    • Instruction ID: 334c9fee3abb3f39d596823d3a3537c7effd0098edc8ca0b3d981ed7cb288a41
                                                                                                                                                                                                                    • Opcode Fuzzy Hash: 7d5e46cc1e5f02d88c983cfba86e53e431cbed6f21b5100807b47a566b29449e
                                                                                                                                                                                                                    • Instruction Fuzzy Hash: F9015A31100709ABEB205F51DD94A9B3B26EB84795F20507AFA007A1D1D7BA9C919E2E
                                                                                                                                                                                                                    Function 00406188 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44registryCOMMON
                                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                    • RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,00004000,00000002,?,00000000,?,?,Remove folder: ,?,?,004063FC,80000002), ref: 004061CE
                                                                                                                                                                                                                    • RegCloseKey.ADVAPI32(?,?,004063FC,80000002,Software\Microsoft\Windows\CurrentVersion,Remove folder: ,Remove folder: ,Remove folder: ,00000000,Remove folder: C:\Users\user\AppData\Local\Temp\nshFAEA.tmp\), ref: 004061D9
                                                                                                                                                                                                                    Strings
                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                    • Source File: 00000000.00000002.2527338492.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527299574.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527452560.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.0000000000460000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.0000000000464000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2528550754.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                    • Snapshot File: hcaresult_0_2_400000_cMqyGFCQHk.jbxd
                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                    • API ID: CloseQueryValue
                                                                                                                                                                                                                    • String ID: Remove folder:
                                                                                                                                                                                                                    • API String ID: 3356406503-1958208860
                                                                                                                                                                                                                    • Opcode ID: caab4bc250bb6a278ef1a8ac262e6d4f4be946af9bdb02c3b8c6b2633afb5ee1
                                                                                                                                                                                                                    • Instruction ID: 8659262355d6ebf2290daf59b07b2549fc881bd87fa0bb5ea6267207f8cb0b09
                                                                                                                                                                                                                    • Opcode Fuzzy Hash: caab4bc250bb6a278ef1a8ac262e6d4f4be946af9bdb02c3b8c6b2633afb5ee1
                                                                                                                                                                                                                    • Instruction Fuzzy Hash: 68017C72500209EADF218F51DD09EDB3BB8EF55364F01403AFE16A61A1D378DA64EBA4
                                                                                                                                                                                                                    Function 004058A3 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 24processCOMMON
                                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                    • CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,04000000,00000000,00000000,00468250,Error launching installer), ref: 004058CC
                                                                                                                                                                                                                    • CloseHandle.KERNEL32(?), ref: 004058D9
                                                                                                                                                                                                                    Strings
                                                                                                                                                                                                                    • Error launching installer, xrefs: 004058B6
                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                    • Source File: 00000000.00000002.2527338492.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527299574.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527452560.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.0000000000460000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.0000000000464000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2528550754.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                    • Snapshot File: hcaresult_0_2_400000_cMqyGFCQHk.jbxd
                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                    • API ID: CloseCreateHandleProcess
                                                                                                                                                                                                                    • String ID: Error launching installer
                                                                                                                                                                                                                    • API String ID: 3712363035-66219284
                                                                                                                                                                                                                    • Opcode ID: 63fdd641d1b9510881a379fce0cbff5cab58f1c092c5a17148380fd449a2e826
                                                                                                                                                                                                                    • Instruction ID: 30392a530fa928b09b8412afc6dc4f2cd20664ca8a9f97139eafb5a2ce14b88a
                                                                                                                                                                                                                    • Opcode Fuzzy Hash: 63fdd641d1b9510881a379fce0cbff5cab58f1c092c5a17148380fd449a2e826
                                                                                                                                                                                                                    • Instruction Fuzzy Hash: 33E09AB5540609BFEB009B64DD05F7B77ACEB04708F508565BD51F2150EB749C148A79
                                                                                                                                                                                                                    Function 00405D15 Relevance: 5.0, APIs: 4, Instructions: 37stringCOMMON
                                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                    • lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00405FFA,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405D25
                                                                                                                                                                                                                    • lstrcmpiA.KERNEL32(00000000,00000000), ref: 00405D3D
                                                                                                                                                                                                                    • CharNextA.USER32(00000000,?,00000000,00405FFA,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405D4E
                                                                                                                                                                                                                    • lstrlenA.KERNEL32(00000000,?,00000000,00405FFA,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405D57
                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                    • Source File: 00000000.00000002.2527338492.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527299574.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527452560.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.000000000040E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.0000000000460000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.0000000000464000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.00000000004FB000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2527514411.00000000004FF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    • Associated: 00000000.00000002.2528550754.000000000059F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                    • Snapshot File: hcaresult_0_2_400000_cMqyGFCQHk.jbxd
                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                    • API ID: lstrlen$CharNextlstrcmpi
                                                                                                                                                                                                                    • String ID:
                                                                                                                                                                                                                    • API String ID: 190613189-0
                                                                                                                                                                                                                    • Opcode ID: 6db5b03da17fe1faae21ad7e2c869b7ed7bb68520138c246bcc2ad94f2104a67
                                                                                                                                                                                                                    • Instruction ID: cc601e2af81a4130f3690bf6756e9ae730db34a97aa71f580e1783f9e5236296
                                                                                                                                                                                                                    • Opcode Fuzzy Hash: 6db5b03da17fe1faae21ad7e2c869b7ed7bb68520138c246bcc2ad94f2104a67
                                                                                                                                                                                                                    • Instruction Fuzzy Hash: 3DF0F631200818FFC7129FA4DD049AFBBA8EF06354B2580BAE840F7211D634DE02AF98